CVE-2013-6404

2013-12-0916:36:47

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.004

Percentile

73.1%

JSON

Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users’ backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.

Affected configurations

Nvd

Node

quassel-ircquassel_ircRange≤0.9.1

quassel-ircquassel_ircMatch0.9.0

VendorProductVersionCPE
quassel-ircquassel_irc*cpe:2.3:a:quassel-irc:quassel_irc:*:*:*:*:*:*:*:*
quassel-ircquassel_irc0.9.0cpe:2.3:a:quassel-irc:quassel_irc:0.9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
quassel-irc	quassel_irc	*	cpe:2.3:a:quassel-irc:quassel_irc::::::::
quassel-irc	quassel_irc	0.9.0	cpe:2.3:a:quassel-irc:quassel_irc:0.9.0:::::::*