VYPR
← All advisories
High severity7.7NVD Advisory· Published Apr 15, 2021· Updated Jun 17, 2026

CVE-2021-29431

CVE-2021-29431

Description

Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
matrix-sydentPyPI
< 2.3.02.3.0

Affected products

3
  • Matrix Org/Sydent2 versions
    cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:*range: <2.3.0
    • (no CPE)range: < 2.3.0
  • ghsa-coords
    pkg:pypi/matrix-sydent
    Range: < 2.3.0

Patches

Vulnerability mechanics

References

11

News mentions

0

No linked articles in our index yet.