CVE-2019-11340: matrix sydent Improper Input Validation
Vulnerability summary
CVE-2019-11340 is a medium (CVSS 5.9) Improper Input Validation vulnerability in matrix sydent. EPSS estimates a 1.88% chance of exploitation in the next 30 days, higher than 79% of scored vulnerabilities.
Timeline
- 19-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · PypiEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.88%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.88% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Matrix1 product
- sydent< 1.0.2
PyPI1 product
- matrix-sydent< 1.0.2
2 vendors · 2 products
References
8 links- matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/X Refsource MISCRelease NotesVendor Advisory
- github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fcX Refsource MISCPatchThird Party AdvisoryWEB
