CVE-2014-2744 in Metronome

Résumé

par MITRE

plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Réserver: 08/04/2014
• Divulgation: 10/04/2014
• Modérer: accepté
• Entrée: VDB-66932
• CPE: prêt
• CWE: CWE-20 (confirmé)
• CVSS: 7.8 (NVD)
• EPSS: 0.03313
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2014-2744
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2014-2744
• CVE Details: https://www.cvedetails.com/cve/CVE-2014-2744/