CVE-2021-29432

Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.

CVSS v3.0 5.7 MEDIUM
CVSS v2.0 3.5 LOW

5.7^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx	Patch Third Party Advisory
https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42	Patch Third Party Advisory
https://pypi.org/project/matrix-sydent/	Product Third Party Advisory
https://github.com/matrix-org/sydent/releases/tag/v2.3.0	Release Notes Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:*

Information

Published : 2021-04-15 14:15

Updated : 2022-08-03 03:17

NVD link : CVE-2021-29432

Mitre link : CVE-2021-29432

JSON object : View

CWE

NVD-CWE-noinfo

Advertisement

Products Affected

matrix

sydent

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx", "name": "https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx", "tags": ["Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42", "name": "https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://pypi.org/project/matrix-sydent/", "name": "https://pypi.org/project/matrix-sydent/", "tags": ["Product", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/matrix-org/sydent/releases/tag/v2.3.0", "name": "https://github.com/matrix-org/sydent/releases/tag/v2.3.0", "tags": ["Release Notes", "Third Party Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-29432", "ASSIGNER": "security-advisories@github.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "LOW", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}}, "publishedDate": "2021-04-15T21:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.3.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-08-03T10:17Z"}