CVE-2019-11340

util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.
Configurations

Configuration 1 (hide)

cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-04-19 14:29

Updated : 2024-02-04 20:20


NVD link : CVE-2019-11340

Mitre link : CVE-2019-11340

CVE.ORG link : CVE-2019-11340


JSON object : View

Products Affected

matrix

  • sydent
CWE
CWE-20

Improper Input Validation