CVE-2019-1000021
slixmpp Incorrect Access Control
7.5
HIGH
CVSS 3.1
EPSS 2.3%
描述
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
如何修補 CVE-2019-1000021
要修補 CVE-2019-1000021,請將受影響套件升級到下列已修補版本。
- —升級至 1.4.2-1 或更新版本
- —升級至 1.4.2 或更新版本
- —升級至 1.4.2 或更新版本
CVE-2019-1000021 正在被利用嗎?
低 — EPSS 為 2.3%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0, < 1.4.2-1
- from 0, < 1.4.2
- from 0, < 1.4.2
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |