Vulnerability Details : CVE-2017-5592
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity (0.4.7 - 0.5.0).
Vulnerability category: Input validation
Products affected by CVE-2017-5592
- cpe:2.3:a:profanity_project:profanity:0.4.7:-:*:*:*:*:*:*
- cpe:2.3:a:profanity_project:profanity:0.4.7:cyg1:*:*:*:*:*:*
- cpe:2.3:a:profanity_project:profanity:0.4.7:cyg2:*:*:*:*:*:*
- cpe:2.3:a:profanity_project:profanity:0.4.7:cyg3:*:*:*:*:*:*
- cpe:2.3:a:profanity_project:profanity:0.4.7:patch1:*:*:*:*:*:*
- cpe:2.3:a:profanity_project:profanity:0.5.0:-:*:*:*:*:*:*
- cpe:2.3:a:profanity_project:profanity:0.5.0:rc1:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5592
0.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 65 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5592
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
5.9
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
2.2
|
3.6
|
NIST |
CWE ids for CVE-2017-5592
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
-
The product does not properly verify that the source of data or communication is valid.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5592
-
https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
Exploit;Technical Description;Third Party Advisory
-
https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
Page not found – rt-solutions.de – experts you can trustExploit;Technical Description;Third Party Advisory
-
http://openwall.com/lists/oss-security/2017/02/09/29
oss-security - CVE-2017-5589+ Multiple XMPP Clients User Impersonation VulnerabilityExploit;Mailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/96173
Profanity XMPP Client CVE-2017-5592 User Impersonation VulnerabilityThird Party Advisory;VDB Entry
-
https://github.com/boothj5/profanity/commit/8e75437a7e43d4c55e861691f74892e666e29b0b
Add carbons from check · profanity-im/profanity@8e75437 · GitHubPatch
Jump to