CVE-2013-1431

2013-09-2320:55:07

CWE-20

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.3

Confidence

Low

EPSS

0.005

Percentile

76.9%

JSON

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a “legacy Jabber server,” does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

Affected configurations

Nvd

Node

simon_mcvittietelepathy_gabbleRange≤0.16.5

simon_mcvittietelepathy_gabbleMatch0.16.0

simon_mcvittietelepathy_gabbleMatch0.16.1

simon_mcvittietelepathy_gabbleMatch0.16.2

simon_mcvittietelepathy_gabbleMatch0.16.3

simon_mcvittietelepathy_gabbleMatch0.16.4

simon_mcvittietelepathy_gabbleMatch0.17.0

simon_mcvittietelepathy_gabbleMatch0.17.1

simon_mcvittietelepathy_gabbleMatch0.17.2

simon_mcvittietelepathy_gabbleMatch0.17.3

VendorProductVersionCPE
simon_mcvittietelepathy_gabble*cpe:2.3:a:simon_mcvittie:telepathy_gabble:*:*:*:*:*:*:*:*
simon_mcvittietelepathy_gabble0.16.0cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.16.0:*:*:*:*:*:*:*
simon_mcvittietelepathy_gabble0.16.1cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.16.1:*:*:*:*:*:*:*
simon_mcvittietelepathy_gabble0.16.2cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.16.2:*:*:*:*:*:*:*
simon_mcvittietelepathy_gabble0.16.3cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.16.3:*:*:*:*:*:*:*
simon_mcvittietelepathy_gabble0.16.4cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.16.4:*:*:*:*:*:*:*
simon_mcvittietelepathy_gabble0.17.0cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.17.0:*:*:*:*:*:*:*
simon_mcvittietelepathy_gabble0.17.1cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.17.1:*:*:*:*:*:*:*
simon_mcvittietelepathy_gabble0.17.2cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.17.2:*:*:*:*:*:*:*
simon_mcvittietelepathy_gabble0.17.3cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.17.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
simon_mcvittie	telepathy_gabble	*	cpe:2.3:a:simon_mcvittie:telepathy_gabble::::::::
simon_mcvittie	telepathy_gabble	0.16.0	cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.16.0:::::::*
simon_mcvittie	telepathy_gabble	0.16.1	cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.16.1:::::::*
simon_mcvittie	telepathy_gabble	0.16.2	cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.16.2:::::::*
simon_mcvittie	telepathy_gabble	0.16.3	cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.16.3:::::::*
simon_mcvittie	telepathy_gabble	0.16.4	cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.16.4:::::::*
simon_mcvittie	telepathy_gabble	0.17.0	cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.17.0:::::::*
simon_mcvittie	telepathy_gabble	0.17.1	cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.17.1:::::::*
simon_mcvittie	telepathy_gabble	0.17.2	cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.17.2:::::::*
simon_mcvittie	telepathy_gabble	0.17.3	cpe:2.3:a:simon_mcvittie:telepathy_gabble:0.17.3:::::::*