Authentication Bypass

2021-05-1422:22:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

68.0%

JSON

prosody is vulnerable to authentication bypass. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impersonate another server (when this option is enabled).

CPENameOperatorVersion
prosody:3.13eq0.11.7-r0
prosody:edgeeq0.11.4-r0
prosody:edgeeq0.11.8-r0
prosody:edgeeq0.11.5-r0
prosody:sideq0.11.7-1
prosody:sideq0.11.8-1
prosody:3.12eq0.11.5-r0
prosody:bullseyeeq0.11.7-1

Name	Operator	Version
prosody:3.13	eq	0.11.7-r0
prosody:edge	eq	0.11.4-r0
prosody:edge	eq	0.11.8-r0
prosody:edge	eq	0.11.5-r0
prosody:sid	eq	0.11.7-1
prosody:sid	eq	0.11.8-1
prosody:3.12	eq	0.11.5-r0
prosody:bullseye	eq	0.11.7-1