Vulnerability in Matrix Sydent
CVE-2023-38686
Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception…
Vulnerability class: Improper Certificate Validation
EPSS: 0.002 (13.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Matrix Sydent
- Matrix-org Sydent — versions < 2.5.6
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Technical Description, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-38686?
- CVE-2023-38686 is a critical-severity vulnerability in Matrix Sydent, classified under Improper Certificate Validation. CVSS score: 9.3/10. Published 2023-08-04.
- How severe is CVE-2023-38686?
- Critical severity. CVSS v3 base score is 9.3 out of 10.