High severity · published May 9, 2019
CVE-2019-11842
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1
7.5
CVSS
1.8%
EPSS
No
On KEV
Description
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sydent · Matrix
before 1.0.3 · source: NVD
SY
Synapse · Matrix
before 0.99.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11842
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11842
Vendor Advisory
https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a/
More from Sydent
7.5
CVE-2021-29430
Sydent is a reference Matrix identity server
6.5
CVE-2021-29431
Sydent is a reference Matrix identity server
5.9
CVE-2019-11340
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled
5.7
CVE-2021-29432
Sydent is a reference matrix identity server
5.3
CVE-2023-38686
Sydent is an identity server for the Matrix communications protocol