// For flags

CVE-2021-39164

Improper authorisation of /members discloses room membership to non-members

Severity Score

3.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.

Matrix es un ecosistema para la Mensajería Instantánea federada abierta y voz sobre IP. En versiones 1.41.0 y anteriores, unos usuarios no autorizados pueden acceder a la membresía (lista de miembros, con sus nombres para mostrar) de una sala si conocen el ID de la misma. La vulnerabilidad es limitada a las salas con visibilidad del historial "shared". Además, el usuario no autorizado debe estar usando una cuenta en un servidor doméstico vulnerable que esté en la sala. Los administradores de servidores deben actualizar a versión 1.41.1 o posterior para recibir el parche. Se presenta una solución disponible. Los administradores de servidores que usan un proxy inverso podrían, con una pérdida de funcionalidad potencialmente inaceptable, bloquear los endpoints: "/_matrix/client/r0/rooms/{room_id}/members" con el parámetro de consulta "at", y "/_matrix/client/unstable/rooms/{room_id}/members" con el parámetro de consulta "at"

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-08-16 CVE Reserved
  • 2021-08-31 CVE Published
  • 2023-11-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Matrix
Search vendor "Matrix"
Synapse
Search vendor "Matrix" for product "Synapse"
< 1.41.1
Search vendor "Matrix" for product "Synapse" and version " < 1.41.1"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
34
Search vendor "Fedoraproject" for product "Fedora" and version "34"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
35
Search vendor "Fedoraproject" for product "Fedora" and version "35"
-
Affected