Is CVE-2023-32323 actively exploited?

CVE-2023-32323 has no public evidence of in-the-wild exploitation as of 2025-02-13.

What is the CVSS score for CVE-2023-32323?

CVE-2023-32323 has a CVSS score of 5 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L.

How do I patch CVE-2023-32323?

Patch guidance is available from matrix security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2023-32323.

CVE-2023-32323 - remediation guidance & executive summary

Description

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Attack Vector: network
Complexity: low
Privileges: low
User Action: none
Scope: changed
Confidentiality: none
Integrity: none
Availability: low
Weaknesses: CWE-20 · Improper Input Validation CWE-20 · Improper Input Validation

Metadata

Primary Vendor: MATRIX
Published: 5/26/2023
Last Modified: 2/13/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

CVE-2023-32323

Description

CVSS Metrics

Metadata

Affected Products

Remediation Guidance

Executive Summary