CVE-2017-5605: XMPP Clients User Impersonation Vulnerability in Movim Moxl
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Movim 0.8 - 0.10.
Other sources
XMPP Clients User Impersonation Vulnerability in Movim Moxl
— Packagist
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5605?
CVE-2017-5605 is considered a medium severity vulnerability due to the potential for social engineering attacks.
How do I fix CVE-2017-5605?
To mitigate CVE-2017-5605, upgrade Movim to the latest version beyond 0.10 which addresses this vulnerability.
What types of software are affected by CVE-2017-5605?
CVE-2017-5605 affects Movim versions 0.8, 0.8.1, 0.9, and 0.10.
What is the impact of CVE-2017-5605?
CVE-2017-5605 allows remote attackers to impersonate users in the application, facilitating various social engineering attacks.
Is there a specific exploit for CVE-2017-5605?
While not detailed in the description, CVE-2017-5605's vulnerability can be exploited through crafted XMPP messages.