CVE-2014-8760

Published: 25/10/2014 Updated: 10/09/2015

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

ejabberd prior to 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Vulnerable Product	Search on Vulmon	Subscribe to Product
process-one ejabberd

Debian Bug report logs - #767535 CVE-2014-8760 Package: ejabberd; Maintainer for ejabberd is Ejabberd Packaging Team <ejabberd@packagesdebianorg>; Source for ejabberd is src:ejabberd (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Fri, 31 Oct 2014 21:15:01 UTC Severity: important Tags: ...

CWE-310 https://github.com/processone/ejabberd/commit/7bdc1151b http://advisories.mageia.org/MGASA-2014-0417.html http://mail.jabber.org/pipermail/operators/2014-October/002438.html http://seclists.org/oss-sec/2014/q4/312 http://www.mandriva.com/security/advisories?name=MDVSA-2014:207 https://bugzilla.redhat.com/show_bug.cgi?id=1153839 http://www.securityfocus.com/bid/70415 http://www.mandriva.com/security/advisories?name=MDVSA-2015:175 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767535

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-8760

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect