Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/12687?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/12687?format=api", "vulnerability_id": "VCID-13kq-f8uw-dyhn", "summary": "Incorrect Default Permissions\nThe `on_get_missing_events` function in `handlers/federation.py` in Matrix Synapse has a security bug in the `get_missing_events` federation API where event visibility rules were not applied correctly.", "aliases": [ { "alias": "CVE-2018-12291" }, { "alias": "GHSA-v8wm-g9f2-xjv4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/196958?format=api", "purl": "pkg:deb/debian/matrix-synapse@0.31.1%2Bdfsg-1?distro=sid", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/matrix-synapse@0.31.1%252Bdfsg-1%3Fdistro=sid" }, { "url": "http://public2.vulnerablecode.io/api/packages/196956?format=api", "purl": "pkg:deb/debian/matrix-synapse@1.152.1-1?distro=sid", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/matrix-synapse@1.152.1-1%3Fdistro=sid" }, { "url": "http://public2.vulnerablecode.io/api/packages/213923?format=api", "purl": "pkg:pypi/matrix-synapse@0.31.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/matrix-synapse@0.31.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/11867?format=api", "purl": "pkg:pypi/matrix-synapse@0.33.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1cxk-wn3b-jycq" }, { "vulnerability": "VCID-3stp-shy4-dudr" }, { "vulnerability": "VCID-3tbz-jcb2-4fdn" }, { "vulnerability": "VCID-43wz-3reu-s3ep" }, { "vulnerability": "VCID-5b91-nm22-5uh4" }, { "vulnerability": "VCID-5d98-hf1n-17aq" }, { "vulnerability": "VCID-5fgp-pcfw-33gk" }, { "vulnerability": "VCID-66cm-6sgb-bqft" }, { "vulnerability": "VCID-arh5-tp1n-nubq" }, { "vulnerability": "VCID-ary1-cnnt-duhg" }, { "vulnerability": "VCID-cff6-n5gz-jfhe" }, { "vulnerability": "VCID-fmqv-a8qr-gqfz" }, { "vulnerability": "VCID-g7rm-55dm-tybk" }, { "vulnerability": "VCID-jg9y-53m4-5bb6" }, { "vulnerability": "VCID-k689-rvyd-e3hp" }, { "vulnerability": "VCID-mmge-uj6j-k3c2" }, { "vulnerability": "VCID-ng8b-cs3a-cqa7" }, { "vulnerability": "VCID-nmup-uep4-b7hw" }, { "vulnerability": "VCID-pg5k-2upe-dudk" }, { "vulnerability": "VCID-ry9q-34p9-auh6" }, { "vulnerability": "VCID-sh81-25ty-4bgn" }, { "vulnerability": "VCID-tug1-g6m1-j3f3" }, { "vulnerability": "VCID-v54a-sjgy-b7ca" }, { "vulnerability": "VCID-vb2z-kkev-aues" }, { "vulnerability": "VCID-z5ga-q6zr-3kb5" }, { "vulnerability": "VCID-zdxd-83uy-hbad" }, { "vulnerability": "VCID-zvev-sm5c-suh6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/matrix-synapse@0.33.5" } ], "affected_packages": [], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-12291", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.003", "scoring_system": "epss", "scoring_elements": "0.53549", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-12291" }, { "reference_url": "https://github.com/matrix-org/synapse", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/synapse" }, { "reference_url": "https://github.com/matrix-org/synapse/commit/0834b49c6a9b6c597a154d4b2dfcf8fff90699ec", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/synapse/commit/0834b49c6a9b6c597a154d4b2dfcf8fff90699ec" }, { "reference_url": "https://github.com/matrix-org/synapse/pull/3371", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/synapse/pull/3371" }, { "reference_url": "https://github.com/matrix-org/synapse/releases/tag/v0.31.1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/matrix-org/synapse/releases/tag/v0.31.1" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901293", "reference_id": "901293", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901293" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12291", "reference_id": "CVE-2018-12291", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12291" }, { "reference_url": "https://usn.ubuntu.com/6076-1/", "reference_id": "USN-6076-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6076-1/" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": "7.0 - 8.9", "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-13kq-f8uw-dyhn" }