{"containers": {"cna": {"affected": [{"product": "sydent", "vendor": "matrix-org", "versions": [{"status": "affected", "version": "< 2.3.0"}]}], "descriptions": [{"lang": "en", "value": "Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-15T20:45:14", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://pypi.org/project/matrix-sydent/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/matrix-org/sydent/releases/tag/v2.3.0"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42"}], "source": {"advisory": "GHSA-mh74-4m5g-fcjx", "discovery": "UNKNOWN"}, "title": "Malicious users could control the content of invitation emails", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-29432", "STATE": "PUBLIC", "TITLE": "Malicious users could control the content of invitation emails"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "sydent", "version": {"version_data": [{"version_value": "< 2.3.0"}]}}]}, "vendor_name": "matrix-org"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20 Improper Input Validation"}]}]}, "references": {"reference_data": [{"name": "https://pypi.org/project/matrix-sydent/", "refsource": "MISC", "url": "https://pypi.org/project/matrix-sydent/"}, {"name": "https://github.com/matrix-org/sydent/releases/tag/v2.3.0", "refsource": "MISC", "url": "https://github.com/matrix-org/sydent/releases/tag/v2.3.0"}, {"name": "https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx", "refsource": "CONFIRM", "url": "https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx"}, {"name": "https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42", "refsource": "MISC", "url": "https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42"}]}, "source": {"advisory": "GHSA-mh74-4m5g-fcjx", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-29432", "datePublished": "2021-04-15T20:45:15", "dateReserved": "2021-03-30T00:00:00", "dateUpdated": "2021-04-15T20:45:14", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:*", "matchCriteriaId": "C77C5A80-7302-49F8-8DAA-37B269691C9C", "versionEndExcluding": "2.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d."}, {"lang": "es", "value": "Sydent es un servidor de identidad de matriz de referencia.&#xa0;Un usuario malicioso podr\u00eda abusar de Sydent para enviar correos electr\u00f3nicos arbitrarios desde la direcci\u00f3n de correo electr\u00f3nico de Sydent.&#xa0;Esto podr\u00eda ser usado para construir correos electr\u00f3nicos de phishing plausibles, por ejemplo.&#xa0;Este problema ha sido corregido en versi\u00f3n 4469d1d"}], "id": "CVE-2021-29432", "lastModified": "2022-08-03T10:17:27.247", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-04-15T21:15:17.630", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/matrix-org/sydent/releases/tag/v2.3.0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx"}, {"source": "security-advisories@github.com", "tags": ["Product", "Third Party Advisory"], "url": "https://pypi.org/project/matrix-sydent/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}