CVE-2017-5602

EUVD-2017-14701
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for jappix 1.0.0 to 1.1.6.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
Affected Products (NVD)
VendorProductVersion
jappix_projectjappix
1.0.0
jappix_projectjappix
1.0.1
jappix_projectjappix
1.0.2
jappix_projectjappix
1.0.3
jappix_projectjappix
1.0.4
jappix_projectjappix
1.0.5
jappix_projectjappix
1.0.6
jappix_projectjappix
1.0.7
jappix_projectjappix
1.1.0
jappix_projectjappix
1.1.1
jappix_projectjappix
1.1.2
jappix_projectjappix
1.1.3
jappix_projectjappix
1.1.4
jappix_projectjappix
1.1.5
jappix_projectjappix
1.1.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://openwall.com/lists/oss-security/2017/02/09/29
http://www.securityfocus.com/bid/96176
https://github.com/jappix/jappix/commit/ea6de7c65b80880bdf85df47c1a8a5d3d68491af
https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
http://openwall.com/lists/oss-security/2017/02/09/29
http://www.securityfocus.com/bid/96176
https://github.com/jappix/jappix/commit/ea6de7c65b80880bdf85df47c1a8a5d3d68491af
https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf