Medium severity · published May 26, 2023
CVE-2022-39374
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Synapse · Matrix
1.62.0 before 1.68.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39374
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39374
Issue Tracking
https://github.com/matrix-org/synapse/pull/13723
Mitigation
https://github.com/matrix-org/synapse/security/advisories/GHSA-p9qp-c452-f9r7
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/
More from Synapse
9.8
CVE-2019-18835
Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs
9.1
CVE-2024-53863
Synapse is an open-source Matrix homeserver
8.8
CVE-2018-16515
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature…
8.2
CVE-2021-21332
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse)
7.5
CVE-2025-30355
Synapse is an open source Matrix homeserver implementation