CVE-2018-10847

Medium

Description

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.

SeverityMedium

CVSS4.2

Exploit probability—

ProductProsody

PublishedJul 30, 2018

First seenJul 30, 2018

Weakness typeCWE-592CWE-592

How to fix

Update

prosody prosody0.9.14 or later

Vendor advisories

debian.org/security/2018/dsa-4216

Affected products

Product	Affected versions	Fixed in
prosody prosody	v < 0.9.14, 0.10.0, 0.10.1	0.9.14

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.