CVE-2017-5592

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity (0.4.7 - 0.5.0).

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20 CWE-346

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://openwall.com/lists/oss-security/2017/02/09/29Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/96173Third Party Advisory, VDB Entry
https://github.com/boothj5/profanity/commit/8e75437a7e43d4c55e861691f74892e666e29b0bPatch
https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/Exploit, Technical Description, Third Party Advisory
https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdfExploit, Technical Description, Third Party Advisory
http://openwall.com/lists/oss-security/2017/02/09/29Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/96173Third Party Advisory, VDB Entry
https://github.com/boothj5/profanity/commit/8e75437a7e43d4c55e861691f74892e666e29b0bPatch
https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/Exploit, Technical Description, Third Party Advisory
https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdfExploit, Technical Description, Third Party Advisory

Timeline

Published: Feb 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-55935.9An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ CVE-2017-55947.5An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's passw CVE-2017-55955.5A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-inpu CVE-2017-55967.5In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the ASTERIX dissector could go into an infinite loop, triggered by packet injection or a mal CVE-2017-55977.5In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the DHCPv6 dissector could go into a large loop, triggered by packet injection or a malforme CVE-2017-55987.5An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can CVE-2017-55996.1An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a reflected Cross Site Scripting vulnerability which affects CVE-2017-56009.8The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging CVE-2017-56017.5An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger CVE-2017-56025.9An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ CVE-2017-56035.9An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ CVE-2017-56045.9An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ