CVE-2017-5592

Severity CVSS v4.0:
Pending analysis
Type:
CWE-20 Input Validation
Publication date:
09/02/2017
Last modified:
20/04/2025

Description

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity (0.4.7 - 0.5.0).

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:profanity_project:profanity:0.4.7:-:*:*:*:*:*:*
cpe:2.3:a:profanity_project:profanity:0.4.7:cyg1:*:*:*:*:*:*
cpe:2.3:a:profanity_project:profanity:0.4.7:cyg2:*:*:*:*:*:*
cpe:2.3:a:profanity_project:profanity:0.4.7:cyg3:*:*:*:*:*:*
cpe:2.3:a:profanity_project:profanity:0.4.7:patch1:*:*:*:*:*:*
cpe:2.3:a:profanity_project:profanity:0.5.0:-:*:*:*:*:*:*
cpe:2.3:a:profanity_project:profanity:0.5.0:rc1:*:*:*:*:*:*