GitHub Advisoryadvisory · npm

GHSA-w973-2qcc-p78x User Impersonation in converse.js

MEDIUM Published 2020-09-11 Modified 2021-09-28 Official page ↗
Aliases
CVE-2017-5858
Ecosystem
npm
Packages
converse.js
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20, CWE-346
Reviewed
2020-08-31

Affected packages

• npm converse.js: < 1.0.7 → fixed in 1.0.7 • npm converse.js: >= 2.0.0, < 2.0.5 → fixed in 2.0.5

Description

Versions of `converse.js` prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of XEP-0280: Message Carbons that allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Recommendation If you're using `converse.js` 1.x, upgrade to 1.0.7 or later. If you're using `converse.js` 2.x, upgrade to 2.0.5 or later.

Related

Alias · CVE (1)

  • CVE-2017-5858 An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user,… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-346 Origin Validation Error weakness

References