Vulnerability · Published Apr 15, 2021 · Assigned by GitHub_M
CVE-2021-29432Malicious users could control the content of invitation emails
Medium 5.3
In plain English
A medium-severity improper input validation in sydent from matrix-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.9%top 39.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | matrix-sydent | 2.3.0 | GHSA-mh74-4m5g-fcjx |
| PyPI | matrix-sydent | 2.3.0 | PYSEC-2021-23 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| matrix-org | sydent | < 2.3.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://pypi.org/project/matrix-sydent/ x_refsource_MISC
- https://github.com/matrix-org/sydent/releases/tag/v2.3.0 x_refsource_MISC
- https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx x_refsource_CONFIRM
- https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42 x_refsource_MISC