Vulnerability Details : CVE-2017-5593
Potential exploit
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Psi+ (0.16.563.580 - 0.16.571.627).
Vulnerability category: Input validation
Products affected by CVE-2017-5593
- cpe:2.3:a:psi-plus:psi\+:0.16.563.580:*:*:*:*:*:*:*
- cpe:2.3:a:psi-plus:psi\+:0.16.571.627:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5593
0.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 45 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5593
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
5.9
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
2.2
|
3.6
|
NIST |
CWE ids for CVE-2017-5593
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
-
The product does not properly verify that the source of data or communication is valid.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5593
-
https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
Exploit;Technical Description;Third Party Advisory
-
https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
Page not found – rt-solutions.de – experts you can trustExploit;Technical Description;Third Party Advisory
-
http://openwall.com/lists/oss-security/2017/02/09/29
oss-security - CVE-2017-5589+ Multiple XMPP Clients User Impersonation VulnerabilityExploit;Mailing List;Third Party Advisory
-
https://github.com/psi-im/iris/pull/47/commits/02e976d4426a1319a7af7d26d7aba9d8c6077570
Try to fix XMPP Client User Impersonation Vulnerability by Vitozz · Pull Request #47 · psi-im/iris · GitHubPatch
-
http://www.securityfocus.com/bid/96169
Psi+ CVE-2017-5593 User Impersonation Vulnerability
Jump to