CVE-2021-21332 Cross-site scripting (XSS) vulnerability in the password reset endpoint
An XSS vulnerability in the password reset endpoint allows attackers to steal cookies and browser data, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21332?
CVE-2021-21332 is a medium-severity cross-site scripting vulnerability in Fedoraproject Fedora, published on 26 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.
Weakness: CWE-79
Which versions are affected by CVE-2021-21332?
3 open source packages ship an affected version, including matrix-synapse. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | All versions | 1.27.0 |
matrix-synapse PyPI | All versions | 1.27.0 |
matrix-synapse PyPI | All versions | 1.27.0 |
Products include Fedoraproject Fedora, Matrix Synapse.
How do I fix CVE-2021-21332?
Upgrade matrix-synapse to 1.27.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-21332 being exploited?
There is no known exploitation of CVE-2021-21332 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-246w-56m2-5899, PYSEC-2021-133, UBUNTU-CVE-2021-21332.