Medium severity · published Apr 15, 2021
CVE-2021-29432
Sydent is a reference matrix identity server
5.7
CVSS
0.9%
EPSS
No
On KEV
Description
Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sydent · Matrix
before 2.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-29432
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-29432
Patch
https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42
Release Notes
https://github.com/matrix-org/sydent/releases/tag/v2.3.0
Patch
https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx
Product
https://pypi.org/project/matrix-sydent/
More from Sydent
7.5
CVE-2021-29430
Sydent is a reference Matrix identity server
7.5
CVE-2019-11842
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1
6.5
CVE-2021-29431
Sydent is a reference Matrix identity server
5.9
CVE-2019-11340
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled
5.3
CVE-2023-38686
Sydent is an identity server for the Matrix communications protocol