4

CVE-2013-6404

Exploit

EPSS 0.45%
Veröffentlicht 09.12.2013 16:36:47
Zuletzt bearbeitet 29.04.2026 01:13:23
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 11

NVD 2 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Quassel-irc ≫ Quassel Irc Version <= 0.9.1

Quassel-irc ≫ Quassel Irc Version0.9.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.45%	0.606

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html

http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html

http://osvdb.org/100432

http://quassel-irc.org/node/123

Patch

Vendor Advisory

http://secunia.com/advisories/55640

Vendor Advisory

http://www.openwall.com/lists/oss-security/2013/11/28/8

https://exchange.xforce.ibmcloud.com/vulnerabilities/89377

https://github.com/quassel/quassel/commit/a1a24da

Patch

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2013-6404

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-6404

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-6404

EUVD