CVE-2017-5603

MEDIUM 5.9CVE-2017-5603 · Published 09/02/2017 · updated 17/06/2026

In short

CVE-2017-5603 is a MEDIUM (CVSS 5.9) vulnerability affecting jitsi (jitsi).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
jitsi jitsi	`= 2.5.5061= 2.9.5544`	No fix yet

Description

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.

References

openwall.com/lists/oss-security/2017/02/09/29 · Exploit
securityfocus.com/bid/96174
jitsi/jitsi commit 7d66da6 · Patch
rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons · Exploit
rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf · Exploit

More vulnerabilities in jitsi

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free