CVE-2018-12423
matrix-synapse: In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.
CVE-2018-12423 is fixed in matrix-synapse on 1 platform by matrix-synapse 0.24.0+dfsg-1ubuntu0.1~esm1 (version 0.24.0+dfsg-1ubuntu0.1~esm1), released November 7, 2019. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0181
78th percentile
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| matrix-synapse · Ubuntu 18.04.6 LTS (bionic) | 0.24.0+dfsg-1ubuntu0.1~esm1 | matrix-synapse 0.24.0+dfsg-1ubuntu0.1~esm1 | Nov 7, 2019 |