CVE-2021-29432 json
Malicious users could control the content of invitation emails
published 2021-04-15 5 y ago modified 2026-09-10 1 mo ago also GHSA-mh74-4m5g-fcjx , PYSEC-2021-23 , EUVD-2021-0121
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 60%
- public exploits
- 0
- none known
Summary
Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.
Patch / fix
- pypi matrix-sydent 2.3.0
- matrix sydent 2.3.0
Exploit prediction
0.93% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | matrix-sydent | <2.3.0 |
2.3.0 |
Affected products
- matrix-org sydent
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42
web, patch, third-party-advisory
-
github.com
/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx
web, patch, third-party-advisory, advisory
-
pypi.org
/project/matrix-sydent/
product, third-party-advisory, package
-
github.com
/matrix-org/sydent/releases/tag/v2.3.0
web, release-notes, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-29432
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2021-23.yaml
web
-
pypi.org
/project/matrix-sydent
web
Sources
- CVE List CVE-2021-29432
- GitHub Advisory GHSA-mh74-4m5g-fcjx
- NVD CVE-2021-29432
- OSV PYSEC-2021-23
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.