Lucene search
HistoryAug 25, 2012 - 4:55 p.m.
CVE-2012-4670
cve-2012-4670
tigase xmpp server
domain spoofing
verify response
authorization response
nvd
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
6.8 Medium
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
70.3%
Tigase XMPP Server before 5.1.0 does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
Affected configurations
Node
tigasetigase_xmpp_serverRange≤5.1.0beta2
| CPE | Name | Operator | Version |
|---|---|---|---|
| tigase:tigase_xmpp_server | tigase tigase xmpp server | le | 5.1.0 |
Related
prion
prion
Server side request forgery (ssrf)
2012-08-25 16:55:00
cvelist
cvelist
CVE-2012-4670
2012-08-25 16:00:00
nvd
nvd
CVE-2012-4670
2012-08-25 16:55:01
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
6.8 Medium
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
70.3%
Related for CVE-2012-4670