CVE-2023-42453

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. This issue has been patched in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-285

• https://github.com/matrix-org/synapse/pull/16327Issue Tracking, Patch
• https://github.com/matrix-org/synapse/security/advisories/GHSA-7565-cq32-vx2xVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AFB2Y3S2VCPCN5P2XCZTG24MBMZ7DM4/Mailing List, Release Notes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65QPC55I4D27HIZP7H2NQ34EOXHPP4AO/Mailing List, Release Notes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY/
• https://security.gentoo.org/glsa/202401-12
• https://github.com/matrix-org/synapse/pull/16327Issue Tracking, Patch
• https://github.com/matrix-org/synapse/security/advisories/GHSA-7565-cq32-vx2xVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AFB2Y3S2VCPCN5P2XCZTG24MBMZ7DM4/Mailing List, Release Notes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65QPC55I4D27HIZP7H2NQ34EOXHPP4AO/Mailing List, Release Notes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6P4QULVUE254WI7XF2LWWOGHCYVFXFY/
• https://security.gentoo.org/glsa/202401-12

Published

Sep 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42448Hydra is the layer-two scalability solution for Cardano. Pri…8.1
• CVE-2023-42449Hydra is the two-layer scalability solution for Cardano. Pri…8.1
• CVE-2023-4245The WooCommerce PDF Invoice Builder for WordPress is vulnera…4.3
• CVE-2023-42450Mastodon is a free, open-source social network server based …7.5
• CVE-2023-42451Mastodon is a free, open-source social network server based …7.5
• CVE-2023-42452Mastodon is a free, open-source social network server based …5.4
• CVE-2023-42454SQLpage is a SQL-only webapp builder. Someone using SQLpage …9.1
• CVE-2023-42455Wazuh is a security detection, visibility, and compliance op…8.8
• CVE-2023-42456Sudo-rs, a memory safe implementation of sudo and su, allows…8.1
• CVE-2023-42457plone.rest allows users to use HTTP verbs such as GET, POST,…7.5
• CVE-2023-42458Zope is an open-source web application server. Prior to vers…5.4
• CVE-2023-42459Fast DDS is a C++ implementation of the DDS (Data Distributi…7.5