CVE-2014-0364

Опубликовано: 30 апр. 2014

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.

Ссылки

http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1176.html
Third Party Advisory
http://secunia.com/advisories/59290
Third Party Advisory
http://secunia.com/advisories/59291
Third Party Advisory
http://www.kb.cert.org/vuls/id/489228
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/67124
Third Party Advisory
VDB Entry
http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1176.html
Third Party Advisory
http://secunia.com/advisories/59290
Third Party Advisory
http://secunia.com/advisories/59291
Third Party Advisory
http://www.kb.cert.org/vuls/id/489228
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/67124
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:igniterealtime:smack:*:*:*:*:*:*:*:*

Версия до 4.0.0 (исключая)

EPSS

Процентиль: 62%

0.00434

Низкий

5 Medium

CVSS2

Дефекты

CWE-345

Связанные уязвимости

CVE-2014-0364

redhat

около 12 лет назад

GHSA-5xpq-f27x-7pw7

github

больше 3 лет назад