CVE-2021-21333

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-74 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-213346.3In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implem CVE-2021-213359.8In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed CVE-2021-213366.5Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before versio CVE-2021-213376.1Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before versio CVE-2021-213386.1TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it CVE-2021-213397.5TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 us CVE-2021-21346.5Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Control Plugin). The supp CVE-2021-213405.4TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that databa CVE-2021-213417.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may all CVE-2021-213429.1XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the p CVE-2021-213437.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the p CVE-2021-213449.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may a