CVE-2013-1431

2013-09-2320:55:07

CWE-20

[email protected]

web.nvd.nist.gov

telepathy gabble

wocky module

cve-2013-1431

tls verification

man-in-the-middle attack

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.3 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.9%

JSON

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a “legacy Jabber server,” does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Affected configurations

NVD

Node

simon_mcvittietelepathy_gabbleRange≤0.16.5

simon_mcvittietelepathy_gabbleMatch0.16.0

simon_mcvittietelepathy_gabbleMatch0.16.1

simon_mcvittietelepathy_gabbleMatch0.16.2

simon_mcvittietelepathy_gabbleMatch0.16.3

simon_mcvittietelepathy_gabbleMatch0.16.4

simon_mcvittietelepathy_gabbleMatch0.17.0

simon_mcvittietelepathy_gabbleMatch0.17.1

simon_mcvittietelepathy_gabbleMatch0.17.2

simon_mcvittietelepathy_gabbleMatch0.17.3

CPENameOperatorVersion
simon_mcvittie:telepathy_gabblesimon mcvittie telepathy gabblele0.16.5
simon_mcvittie:telepathy_gabblesimon mcvittie telepathy gabbleeq0.16.0
simon_mcvittie:telepathy_gabblesimon mcvittie telepathy gabbleeq0.16.1
simon_mcvittie:telepathy_gabblesimon mcvittie telepathy gabbleeq0.16.2
simon_mcvittie:telepathy_gabblesimon mcvittie telepathy gabbleeq0.16.3
simon_mcvittie:telepathy_gabblesimon mcvittie telepathy gabbleeq0.16.4
simon_mcvittie:telepathy_gabblesimon mcvittie telepathy gabbleeq0.17.0
simon_mcvittie:telepathy_gabblesimon mcvittie telepathy gabbleeq0.17.1
simon_mcvittie:telepathy_gabblesimon mcvittie telepathy gabbleeq0.17.2
simon_mcvittie:telepathy_gabblesimon mcvittie telepathy gabbleeq0.17.3

CPE	Name	Operator	Version
simon_mcvittie:telepathy_gabble	simon mcvittie telepathy gabble	le	0.16.5
simon_mcvittie:telepathy_gabble	simon mcvittie telepathy gabble	eq	0.16.0
simon_mcvittie:telepathy_gabble	simon mcvittie telepathy gabble	eq	0.16.1
simon_mcvittie:telepathy_gabble	simon mcvittie telepathy gabble	eq	0.16.2
simon_mcvittie:telepathy_gabble	simon mcvittie telepathy gabble	eq	0.16.3
simon_mcvittie:telepathy_gabble	simon mcvittie telepathy gabble	eq	0.16.4
simon_mcvittie:telepathy_gabble	simon mcvittie telepathy gabble	eq	0.17.0
simon_mcvittie:telepathy_gabble	simon mcvittie telepathy gabble	eq	0.17.1
simon_mcvittie:telepathy_gabble	simon mcvittie telepathy gabble	eq	0.17.2
simon_mcvittie:telepathy_gabble	simon mcvittie telepathy gabble	eq	0.17.3