XMPP Client Vulnerability in Movim by Movim
CVE-2017-5605

5.9MEDIUM

Key Information:

Vendor

Movim

Status
Movim
Vendor
CVE Published:
9 February 2017

What is CVE-2017-5605?

An incorrect implementation of the XEP-0280: Message Carbons in Movim versions 0.8 to 0.10 enables a remote attacker to impersonate any user displayed within the application. This critical flaw makes it possible for attackers to conduct social engineering attacks by deceiving users regarding the identity of contacts, ultimately undermining trust and security in communications. Immediate attention and updates are recommended to mitigate these risks.

References

http://openwall.com/lists/oss-security/2017/02/09/29
x_refsource_MISC
http://www.securityfocus.com/bid/96177
vdb-entryx_refsource_BID
https://github.com/movim/moxl/commit/838b0a42efc3b67cc17d...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.