CVEvulnerability
CVE-2017-5606
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-02-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20, CWE-346
Description
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android).
Affected configurations
• xabber xabber (<= 1.0.30)
Related
References
- http://openwall.com/lists/oss-security/2017/02/09/29 Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/96186 Third Party Advisory, VDB Entry
- https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ Exploit, Technical Description, Third Party Advisory
- https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf Exploit, Technical Description, Third Party Advisory
- http://openwall.com/lists/oss-security/2017/02/09/29 Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/96186 Third Party Advisory, VDB Entry
- https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ Exploit, Technical Description, Third Party Advisory
- https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf Exploit, Technical Description, Third Party Advisory