4

CVE-2013-6404

Exploit
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Quassel-irc ≫ Quassel Irc Version <= 0.9.1
Quassel-irc ≫ Quassel Irc Version0.9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.06% 0.788
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html
http://osvdb.org/100432
http://quassel-irc.org/node/123
Patch
Vendor Advisory
http://secunia.com/advisories/55640
Vendor Advisory
http://www.openwall.com/lists/oss-security/2013/11/28/8
https://exchange.xforce.ibmcloud.com/vulnerabilities/89377
https://github.com/quassel/quassel/commit/a1a24da
Patch
Exploit