CVE-2017-5591

Description

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable applications display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.

Risk Information

Base Score

5.9

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Score

Exploitation Probability

0.456

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2017-5591 are fixed in Python-sleekxmpp 1.3.2	Windows
Vulnerabilities CVE-2017-5591 are fixed in Python-slixmpp 1.2.4	Windows
Vulnerabilities CVE-2017-5591 are fixed in Python-sleekxmpp for linux 1.3.2	Linux
Vulnerabilities CVE-2017-5591 are fixed in Python-slixmpp for linux 1.2.4	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234