Description

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Converse.js (0.8.0 - 1.0.6, 2.0.0 - 2.0.4).

Remediation

References

https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf

https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/

https://github.com/jcbrand/converse.js/commit/42f249cabbbf5c026398e6d3b350f6f9536ea572

http://openwall.com/lists/oss-security/2017/02/09/29

http://www.securityfocus.com/bid/96183

Related Vulnerabilities

CVE-2014-1216 Vulnerability in maven package org.fitnesse:fitnesse

CVE-2020-13822 Vulnerability in maven package org.webjars.npm:elliptic

CVE-2020-13128 Vulnerability in maven package com.googlecode.gwtupload:gwtupload

CVE-2022-22965 Vulnerability in maven package org.springframework:spring-beans

CVE-2023-0842 Vulnerability in npm package xml2js

Severity

Medium

Classification

CWE-20 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Exploit Technical Description Third Party Advisory Patch Mailing List