CVE-2021-32917

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
May 13, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-329187.5An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacksCVE-2021-329197.5An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental CVE-2021-329207.5Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.CVE-2021-329215.9An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when runninCVE-2021-329237.4HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those withiCVE-2021-329248.8Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\frCVE-2021-329256.5admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.CVE-2021-329267.5When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includeCVE-2021-329276.1An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker.CVE-2021-329289.8The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows iCVE-2021-329298.8All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user.CVE-2021-32935.3emlog v5.3.1 has full path disclosure vulnerability in t/index.php, which allows an attacker to see the path to the webroot/file.
CVE-2021-32917: Medium severity, CVSS 5.3 | Vulnix