High severity · published Jul 30, 2018
CVE-2018-10847
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass
8.8
CVSS
1.6%
EPSS
No
On KEV
Description
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Prosody · Prosody
before 0.9.14; 0.10.0; 0.10.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-10847
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-10847
Vendor Advisory
https://blog.prosody.im/prosody-0-10-2-security-release/
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10847
Vendor Advisory
https://issues.prosody.im/1147
Vendor Advisory
https://prosody.im/security/advisory_20180531/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4216
More from Prosody
7.5
CVE-2026-43507
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5
7.5
CVE-2026-43506
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5
7.5
CVE-2022-0217
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data
7.5
CVE-2021-37601
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat…
7.5
CVE-2021-32920
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests