CVE-2014-2744 in Metronome

सारांश

द्वारा MITRE

plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• आरक्षित करना: 08/04/2014
• प्रकटीकरण: 10/04/2014
• संयम: स्वीकृत
• प्रविष्टि: VDB-66932
• CPE: तैयार
• CWE: CWE-20 (पुष्टि की गई)
• CVSS: 7.8 (NVD)
• EPSS: 0.03313
• KEV: नहीं
• गतिविधियाँ: बहुत कम

स्रोत

• MITRE: https://www.cve.org/CVERecord?id=CVE-2014-2744
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2014-2744
• CVE Details: https://www.cvedetails.com/cve/CVE-2014-2744/