CVE-2021-37601 — Resource Exposure in Prosody

CWE-668 — Resource Exposure4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.7%
top 28.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ProsodyDebian Prosody
Timeline
PublishedJul 30
Latest updateMay 24

Description

muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/prosody< prosody 0.11.9-2 (bookworm)
▶Debianprosody/prosody< 0.11.9-2+3
▶NVDprosody/prosody0.11.0 — 0.11.9

🔴Vulnerability Details

2
GHSA
GHSA-h6g2-mc2x-j8wm: muc↗2022-05-24
▶
OSV
CVE-2021-37601: muc↗2021-07-30
▶

📋Vendor Advisories

1
Debian
CVE-2021-37601: prosody - muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain s...↗2021
▶
CVE-2021-37601 — Resource Exposure in Debian Prosody | cvebase