7.1
CVSSv3

CVE-2023-28686

Published: 24/03/2023 Updated: 07/11/2023
CVSS v3 Base Score: 7.1 | Impact Score: 4.2 | Exploitability Score: 2.8
VMScore: 0

Vulnerability Summary

Dino prior to 0.2.3, 0.3.x prior to 0.3.2, and 0.4.x prior to 0.4.2 allows malicious users to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.

Vulnerable Product Search on Vulmon Subscribe to Product

dino dino

fedoraproject fedora 36

fedoraproject fedora 37

fedoraproject fedora 38

debian debian linux 10.0

debian debian linux 11.0

debian debian linux 12.0

Vendor Advisories

Debian Bug report logs - #1033370 dino-im: Insufficient message sender validation in Dino CVE-2023-28686 Package: dino-im; Maintainer for dino-im is Debian XMPP Maintainers <pkg-xmpp-devel@listsaliothdebianorg>; Source for dino-im is src:dino-im (PTS, buildd, popcon) Reported by: Diane Trout <diane@ghicorg> Date: ...
Kim Alvefur discovered that insufficient message sender validation in dino-im, a modern XMPP/Jabber client, may result in manipulation of entries in the personal bookmark store without user interaction via a specially crafted message Additionally an attacker can take advantage of this flaw to change how group chats are displayed or force a user to ...