Matrix Sydent
7 CVEs affecting Matrix Sydent. Latest disclosed: 2023-08-04. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38686 | Critical | 9.3 | 2023-08-04 | Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMT… |
CVE-2021-29431 | High | 7.7 | 2021-04-15 | Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP ad… |
CVE-2021-29430 | High | 7.5 | 2021-04-15 | Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP req… |
CVE-2019-11842 | High | 7.5 | 2019-05-09 | An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers… |
CVE-2019-11340 | Medium | 5.9 | 2019-04-19 | util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is ena… |
CVE-2021-29432 | Medium | 5.3 | 2021-04-15 | Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be use… |
CVE-2021-29433 | Medium | 4.3 | 2021-04-15 | Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoints used to confirm… |