Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SSRF in Sydent due to missing validation of hostnames
Vulnerability Description
Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Vulnerability Type
输入验证不恰当
Vulnerability Title
Matrix Sydent 代码问题漏洞
Vulnerability Description
Matrix Sydent是英国Matrix.org基金会的一款Matrix身份验证服务器API的实现。 Sydent 存在安全漏洞，该漏洞源于缺乏参数验证或IP地址黑名单，可能导致Sydent向内部系统发送HTTP GET请求。
CVSS Information
N/A
Vulnerability Type
N/A