Ubuntu.comUB:CVE-2017-5591CVE-2017-5591
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
0.002 Low
EPSS
Percentile
59.3%
An incorrect implementation of “XEP-0280: Message Carbons” in multiple XMPP
clients allows a remote attacker to impersonate any user, including
contacts, in the vulnerable application’s display. This allows for various
kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1
and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and
other products.
Bugs
References
openwall.com/lists/oss-security/2017/02/09/29
github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8
launchpad.net/bugs/cve/CVE-2017-5591
nvd.nist.gov/vuln/detail/CVE-2017-5591
rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
security-tracker.debian.org/tracker/CVE-2017-5591
www.cve.org/CVERecord?id=CVE-2017-5591
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
0.002 Low
EPSS
Percentile
59.3%