CVE-2021-29432 MEDIUM

CVE-2021-29432: Malicious users could control the content of invitation emails

Vendor Matrix-Org
Product sydent
Weakness CWE-20 · Input validation
Published April 15, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.

Key dates

02Disclosure timeline

April 15, 2021 CVE published
August 3, 2024 Record updated