CVE-2020-26547

Katalog CVE

CVSS 9.8 · Critical EPSS 0,55%

Kerentanan Insufficient Verification of Data Authenticity pada monal. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results. This allows a remote attacker (able to send stanzas to a victim) to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim.

Rincian

Terbit di NVD

1 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://monal.im/blog/cve-2020-26547/ advisory vendor
• https://github.com/anurodhp/Monal/commits/develop advisory pihak ketiga