CVE-2023-32682— Matrix Synapse 授权问题漏洞
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2023-32682 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Improper checks for deactivated users during login in synapse
来源: CVE Program / CVE List V5
Vulnerability Description
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the `jwt_config.enabled` configuration setting. 2. The local password database is enabled via the `password_config.enabled` and `password_config.localdb_enabled` configuration settings *and* a user's password is updated via an admin API after a user is deactivated. Note that the local password database is enabled by default, but it is uncommon to set a user's password after they've been deactivated. Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected. If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This issue has been addressed in version 1.85.0. Users are advised to upgrade.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
来源: CVE Program / CVE List V5
Vulnerability Title
Matrix Synapse 授权问题漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Matrix Synapse是英国Matrix基金会的一款矩阵管理服务器的实现。 Matrix Synapse 1.85.0之前版本存在授权问题漏洞，该漏洞源于停用的用户可能会在使用不常见的配置时登录。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| matrix-org | synapse | < 1.85.0 | - |
二、漏洞 CVE-2023-32682 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2023-32682 的情报信息
请登录查看更多情报信息。
CVE-2023-32682 补丁与修复 (2)
- https://github.com/matrix-org/synapse/pull/15634x_refsource_MISC
- https://github.com/matrix-org/synapse/pull/15624x_refsource_MISC
CVE-2023-32682 厂商安全公告 (1)
CVE-2023-32682 邮件列表归档 (1)
CVE-2023-32682 安全博客文章 (3)
- https://matrix-org.github.io/synapse/latest/jwt.htmlx_refsource_MISC
IV. Related Vulnerabilities
V. Comments for CVE-2023-32682
暂无评论