Is CVE-2023-32683 actively exploited?

No active exploitation of CVE-2023-32683 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-32683 be exploited remotely?

Yes. CVE-2023-32683 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-32683?

CVE-2023-32683 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2023-32683

MEDIUM

CVE-2023-32683

CWE-863Published: June 6, 2023· Updated: Jun 17, 2026

5.4

CVSS v3.1

Official Description

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the `url_preview_ip_range_blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client: 1. For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. 2. For discovered image URLs, any non-image response is discarded. Systems which have URL preview disabled (via the `url_preview_enabled` setting) or have not configured a `url_preview_url_blacklist` are not affected. This issue has been addressed in version 1.85.0. Users are advised to upgrade. User unable to upgrade may also disable URL previews.

NVD Source

Technical Analysis

CVE-2023-32683 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.