Design/Logic Flaw

2017-02-0920:59:00

PRIOn knowledge base

www.prio-n.com

5.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.6%

JSON

An incorrect implementation of “XEP-0280: Message Carbons” in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application’s display. This allows for various kinds of social engineering attacks. This CVE is for Movim 0.8 - 0.10.

CPENameOperatorVersion
movimeq0.9
movimeq0.8
movimeq0.8.1
movimeq0.10

Name	Operator	Version
movim	eq	0.9
movim	eq	0.8
movim	eq	0.8.1
movim	eq	0.10

References

openwall.com/lists/oss-security/2017/02/09/29

www.securityfocus.com/bid/96177

github.com/movim/moxl/commit/838b0a42efc3b67cc17d63e25ae1d0ea849cd89b

rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/

rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf