PT-2021-11244 · Monal · Monal

Published 2021-02-01 · Updated 2021-02-05 · CVE-2020-26547

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Monal versions prior to 4.9

Description: The issue allows a remote attacker, who can send stanzas to a victim, to inject arbitrary messages into the local history. This gives the attacker full control over the sender and receiver displayed to the victim. The problem arises from the lack of proper sender verification on MAM and Message Carbon (XEP-0280) results.

Recommendations: For versions prior to 4.9, update to version 4.9 or later to resolve the issue. As a temporary workaround, consider restricting access to MAM and Message Carbon (XEP-0280) results until the update is applied.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2020-26547

Affected Products

Monal

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-26547 · Security Note
• https://monal.im/blog/cve-2020-26547 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26547 · Vendor Advisory
• https://github.com/anurodhp/Monal/commits/develop · Note
• https://t.me/cvenotify/9213 · Telegram Post
• https://t.me/cvenotify/9195 · Telegram Post