CVE-2016-0756 — Improper Input Validation in Prosody

CWE-20 — Improper Input Validation7 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
0.7%
top 28.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ProsodyDebian Prosody
Timeline
PublishedJan 29
Latest updateMay 17

Description

The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶debiandebian/prosody< prosody 0.9.10-1 (bookworm)
▶Debianprosody/prosody< 0.9.10-1+3
▶NVDprosody/prosody0.9.9

Patches

Patch: blog.prosody.im ↗Patch: blog.prosody.im ↗

🔴Vulnerability Details

2
GHSA
GHSA-xf9v-h9f2-2phh: The generate_dialback function in the mod_dialback module in Prosody before 0↗2022-05-17
▶
OSV
CVE-2016-0756: The generate_dialback function in the mod_dialback module in Prosody before 0↗2016-01-29
▶

📋Vendor Advisories

1
Debian
CVE-2016-0756: prosody - The generate_dialback function in the mod_dialback module in Prosody before 0.9....↗2016
▶

💬Community

3
Bugzilla
CVE-2016-0756 prosody: mod_dialback allows impersonation attacks [epel-all]↗2016-01-28
▶
Bugzilla
CVE-2016-0756 prosody: mod_dialback allows impersonation attacks [fedora-all]↗2016-01-28
▶
Bugzilla
CVE-2016-0756 prosody: mod_dialback allows impersonation attacks↗2016-01-27
▶
CVE-2016-0756 — Improper Input Validation in Prosody | cvebase