JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
oryginał ENCVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HJabberd2
APPJabberd2≤ 2.6.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Referencje
Powiązane podatności
CVE-2017-18225HIGH7.8ten sam produkt
The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s...
CVE-2011-1755HIGH7.5ten sam produkt
jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attacke...
CVE-2017-18226MEDIUM5.5ten sam produkt
The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, ...
CVE-2015-2058MEDIUM6.5ten sam produkt
c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-...
CVE-2012-3525MEDIUM5.8ten sam produkt
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback r...