Critical severity · published Sep 24, 2024
CVE-2024-46957
Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XM
Xmpp · Mellium
0.0.1 through 0.21.4 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-46957
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-46957
codeberg.org
https://codeberg.org/mellium/xmpp/releases
mellium.im
https://mellium.im/cve/cve-2024-46957/
More from Xmpp
5.9
CVE-2022-24968
In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without…