CVE-2021-29432 Malicious users could control the content of invitation emails

2021-04-1520:45:15

CWE-20

GitHub_M

www.cve.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.7%

JSON

Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.

CNA Affected

[
  {
    "product": "sydent",
    "vendor": "matrix-org",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.3.0"
      }
    ]
  }
]