4

CVE-2013-6404

Exploit

EPSS 0.45%
Veröffentlicht 09.12.2013 16:36:47
Zuletzt bearbeitet 11.04.2025 00:51:21
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 11

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Quassel-irc ≫ Quassel Irc Version <= 0.9.1

Quassel-irc ≫ Quassel Irc Version0.9.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.45%	0.606

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html

http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html

http://osvdb.org/100432

http://quassel-irc.org/node/123

Patch

Vendor Advisory

http://secunia.com/advisories/55640

Vendor Advisory

http://www.openwall.com/lists/oss-security/2013/11/28/8

https://exchange.xforce.ibmcloud.com/vulnerabilities/89377

https://github.com/quassel/quassel/commit/a1a24da

Patch

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2013-6404

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-6404

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-6404

EUVD