GHSA-w973-2qcc-p78x

Source

https://github.com/advisories/GHSA-w973-2qcc-p78x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-w973-2qcc-p78x/GHSA-w973-2qcc-p78x.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-w973-2qcc-p78x

Aliases

CVE-2017-5858

Published

2020-09-11T21:19:09Z

Modified

2023-11-01T04:48:14.222855Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

User Impersonation in converse.js

Details

Versions of converse.js prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of XEP-0280: Message Carbons that allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks.

Recommendation

If you're using converse.js 1.x, upgrade to 1.0.7 or later. If you're using converse.js 2.x, upgrade to 2.0.5 or later.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-20",
        "CWE-346"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:42:38Z"
}

References

Affected packages

npm / converse.js

Package

Name: converse.js; View open source insights on deps.dev
Purl: pkg:npm/converse.js

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.7