PT-2018-10138 · Prosody+3 · Prosody+3

Princess Pepperoni · Publicado 2018-06-02 · Atualizado 2021-03-15 · CVE-2018-10847

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.10.2 Prosody version 0.9.14

Description The issue allows for an authentication bypass. It occurs because Prosody does not verify that the virtual host associated with a user session remains the same across stream restarts. This means a user may authenticate to one XMPP host and then migrate their authenticated session to another XMPP host of the same Prosody instance.

Recommendations For versions prior to 0.10.2, update to version 0.10.2 or later. For version 0.9.14, consider upgrading to a newer version to mitigate the risk, as 0.9.14 is specifically mentioned as vulnerable.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-592

CWE-287

Identificadores relacionados

ALT-PU-2018-2853

CVE-2018-10847

DSA-4216-1

OPENSUSE-SU-2018_1627-1

OPENSUSE-SU-2018_1632-1

USN-4834-1

Produtos afetados

Alt Linux

Prosody

Suse

Ubuntu

Referências · 17

• https://nvd.nist.gov/vuln/detail/CVE-2018-10847 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-4216-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-10847 · Aviso do Fabricante
• https://prosody.im/security/advisory_20180531/issue1147-0.9.patch · Nota
• https://cve.org/CVERecord?id=CVE-2018-10847 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10847 · Aviso do Fabricante
• https://prosody.im/security/advisory_20180531 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-10847 · Aviso do Fabricante
• https://prosody.im/security/advisory_20180531/issue1147-0.10.1.patch · Nota
• https://blog.prosody.im/prosody-0-10-2-security-release · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4834-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4834-1 · Aviso do Fabricante
• https://issues.prosody.im/1147 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-10847 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-10847 · Aviso do Fabricante