CVEvulnerability

CVE-2017-5602

5.9 MEDIUM Published 2017-02-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-02-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-20, CWE-346

Description

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for jappix 1.0.0 to 1.1.6.

Affected configurations

• jappix project jappix 1.0.0 • jappix project jappix 1.0.1 • jappix project jappix 1.0.2 • jappix project jappix 1.0.3 • jappix project jappix 1.0.4 • jappix project jappix 1.0.5 • jappix project jappix 1.0.6 • jappix project jappix 1.0.7 • jappix project jappix 1.1.0 • jappix project jappix 1.1.1 • jappix project jappix 1.1.2 • jappix project jappix 1.1.3 • jappix project jappix 1.1.4 • jappix project jappix 1.1.5 • jappix project jappix 1.1.6

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-346 Origin Validation Error weakness

References