Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2024-46957

Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0.

VectorNETWORK

PublishedSep 25, 2024, 01:15

Published Bycve@mitre.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

mellium.im/xmpp(Go)00.22.0N/A

References

https://codeberg.org/mellium/xmpp/releases
https://mellium.im/cve/cve-2024-46957/

Weakness Type

CWE-290

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK