SSRF in Matrix Sydent
CVE-2021-29431
Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request hea…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.012 (64.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Matrix Sydent
- Matrix-org Sydent — versions < 2.3.0
Weakness classification (CWE)
References
- security-advisories@github.com (Product, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-29431?
- CVE-2021-29431 is a high-severity vulnerability in Matrix Sydent, classified under Improper Input Validation. CVSS score: 7.7/10. Published 2021-04-15.
- How severe is CVE-2021-29431?
- High severity. CVSS v3 base score is 7.7 out of 10.