CVE-2017-5592

MEDIUM 5.9CVE-2017-5592 · Published 09/02/2017 · updated 17/06/2026

In short

CVE-2017-5592 is a MEDIUM (CVSS 5.9) vulnerability affecting profanity (profanity project).
Chance of exploitation in the next 30 days (EPSS): 0.84%, higher than 58.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
profanity profanity_project	`= 0.4.7= 0.5.0`	No fix yet

Description

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity (0.4.7 - 0.5.0).

References

openwall.com/lists/oss-security/2017/02/09/29 · Exploit
securityfocus.com/bid/96173 · Third Party Advisory
boothj5/profanity commit 8e75437 · Patch
rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons · Exploit
rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf · Exploit

More vulnerabilities in profanity

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free