FKIE_CVE-2017-5858

Vulnerability from fkie_nvd - Published: 2017-02-09 20:59 - Updated: 2025-04-20 01:37
Severity ?
5.9 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Converse.js (0.8.0 - 1.0.6, 2.0.0 - 2.0.4).
References
cve@mitre.orghttp://openwall.com/lists/oss-security/2017/02/09/29Exploit, Mailing List, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/96183
cve@mitre.orghttps://github.com/jcbrand/converse.js/commit/42f249cabbbf5c026398e6d3b350f6f9536ea572Patch
cve@mitre.orghttps://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/Exploit, Technical Description, Third Party Advisory
cve@mitre.orghttps://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdfExploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2017/02/09/29Exploit, Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/96183
af854a3a-2127-422b-91ae-364da2661108https://github.com/jcbrand/converse.js/commit/42f249cabbbf5c026398e6d3b350f6f9536ea572Patch
af854a3a-2127-422b-91ae-364da2661108https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/Exploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdfExploit, Technical Description, Third Party Advisory
Impacted products
Vendor Product Version
conversejs converse.js 0.8.0
conversejs converse.js 0.8.1
conversejs converse.js 0.8.2
conversejs converse.js 0.8.3
conversejs converse.js 0.8.4
conversejs converse.js 0.8.5
conversejs converse.js 0.8.6
conversejs converse.js 0.9.0
conversejs converse.js 0.9.1
conversejs converse.js 0.9.2
conversejs converse.js 0.9.3
conversejs converse.js 0.9.4
conversejs converse.js 0.9.5
conversejs converse.js 0.9.6
conversejs converse.js 0.10.0
conversejs converse.js 0.10.1
conversejs converse.js 1.0.0
conversejs converse.js 1.0.1
conversejs converse.js 1.0.2
conversejs converse.js 1.0.3
conversejs converse.js 1.0.4
conversejs converse.js 1.0.5
conversejs converse.js 1.0.6
conversejs converse.js 2.0.0
conversejs converse.js 2.0.1
conversejs converse.js 2.0.2
conversejs converse.js 2.0.3
conversejs converse.js 2.0.4
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B72CEF80-A5C4-4908-847E-A42A133EB750",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE82BC23-CAC5-460C-9BE1-F4A01826ACD8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D74A2AD5-7E0D-4A05-99D2-6CCD9F065D40",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "3BB99343-F9CD-453D-B741-75D8E375A64E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F0B149D-BB35-47F1-B2EE-A46FA85DFF21",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.8.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE663F25-9D54-4484-A5FB-F9F39BB0A4DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.8.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FAD2155-0AEF-4080-908C-F53CA367C7C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C9D0125-3D83-4152-9AF6-0E612BAC78B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "428EA3B5-91C3-4671-BAD7-8F8E838B80F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.9.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "30784FCD-8079-4A9F-9EEF-28694D55ECE5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.9.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B29B31EC-93CD-4468-AD37-563EE88FEF94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.9.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E3D04A3-C34C-4F3E-A110-7B7AFAAAA7F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.9.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF40A4B8-CE97-476C-A911-304774E46A4F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.9.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD977F45-D0C0-4E76-A294-5F2A7CFF3A6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA079B97-06AE-480E-9A26-08D958560374",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:0.10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "363EEFEB-2C3F-475D-AA40-5C1A7C271775",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C8D4BC6-2806-4FF1-8CE4-613722BEA340",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "3BC62AB6-3060-4B44-AAB9-CBEBB7505188",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FE58D9C-5F96-4B60-9356-B55AD4997CAF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0441FCA3-D517-4B41-B687-EF3454327398",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "886B3A14-6BDC-4CB7-8268-6DF1D872BCC5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:1.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF33D02B-6C96-4AF4-AD5B-FFBFE757BF31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:1.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA1451B0-EE4D-499B-8458-7538F7378EBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2D9477A-990E-441B-80DF-DE43A81244D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:2.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC93F612-E5C1-4B84-8031-38EA8EE4CBB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:2.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CC002A9-F935-46BD-ADFD-A4107C70B0FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:2.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E79F1ABC-116B-49F4-A5A5-7712F866EC63",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:conversejs:converse.js:2.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D618B06-D4B3-4B49-96E0-DB0D357B656E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application\u0027s display. This allows for various kinds of social engineering attacks. This CVE is for Converse.js (0.8.0 - 1.0.6, 2.0.0 - 2.0.4)."
    },
    {
      "lang": "es",
      "value": "Una implementaci\u00f3n incorrecta de \"XEP-0280: Message Carbons\" en m\u00faltiples clientes XMPP permite a un atacante remoto personificar cualquier usuario, incluidos los contactos, en la pantalla de la aplicaci\u00f3n vulnerable. Esto permite varios tipos de ataques de ingenier\u00eda social. Esta CVE es para Converse.js (0.8.0 - 1.0.6, 2.0.0 - 2.0.4)."
    }
  ],
  "id": "CVE-2017-5858",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-02-09T20:59:00.577",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://openwall.com/lists/oss-security/2017/02/09/29"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/96183"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jcbrand/converse.js/commit/42f249cabbbf5c026398e6d3b350f6f9536ea572"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://openwall.com/lists/oss-security/2017/02/09/29"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/96183"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jcbrand/converse.js/commit/42f249cabbbf5c026398e6d3b350f6f9536ea572"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.