What is CVE-2021-29431?

CVE-2021-29431 is a high-severity vulnerability in Matrix Sydent, classified under Improper Input Validation. CVSS score: 7.7/10. Published 2021-04-15.

How severe is CVE-2021-29431?

High severity. CVSS v3 base score is 7.7 out of 10.

SSRF in Matrix Sydent

CVE-2021-29431

Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2021-04-15 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.012 (66.8th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 67th percentile — 66.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000

Affected products

Matrix Sydent
Matrix-Org Sydent — versions < 2.3.0

Weakness classification (CWE)

References

pypi.org/project/matrix-sydent/ (Product, Third Party Advisory)
github.com/matrix-org/sydent/releases/tag/v2.3.0 (Third Party Advisory, Release Notes)
github.com/matrix-org/sydent/security/advisories/GHSA-9jhm-8m8c-c3f4 (Patch, Third Party Advisory)
github.com/matrix-org/sydent/commit/9e573348d81df8191bbe8c266c01999c9d57cd5f (Patch, Third Party Advisory)
github.com/matrix-org/sydent/commit/8936925f561b0c352c2fa922d5097d7245aad00a (Patch, Third Party Advisory)
github.com/matrix-org/sydent/commit/3d531ed50d2fd41ac387f36d44d3fb2c62dd22d3 (Patch, Third Party Advisory)
github.com/matrix-org/sydent/commit/0f00412017f25619bc36c264b29ea96808bf310a (Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2021-29431?: CVE-2021-29431 is a high-severity vulnerability in Matrix Sydent, classified under Improper Input Validation. CVSS score: 7.7/10. Published 2021-04-15.
How severe is CVE-2021-29431?: High severity. CVSS v3 base score is 7.7 out of 10.