4

CVE-2013-6404

Exploit

EPSS 0.45%
Published 09.12.2013 16:36:47
Last modified 11.04.2025 00:51:21
Source secalert@redhat.com
Teams watchlist Login
Open Login

Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.

Affected products Warnungen 0 Metrics 2 CWE 0 References 11

Data is provided by the National Vulnerability Database (NVD)

Quassel-irc ≫ Quassel Irc Version <= 0.9.1

Quassel-irc ≫ Quassel Irc Version0.9.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.45%	0.606

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html

http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html

http://osvdb.org/100432

http://quassel-irc.org/node/123

Patch

Vendor Advisory

http://secunia.com/advisories/55640

Vendor Advisory

http://www.openwall.com/lists/oss-security/2013/11/28/8

https://exchange.xforce.ibmcloud.com/vulnerabilities/89377

https://github.com/quassel/quassel/commit/a1a24da

Patch

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2013-6404

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-6404

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-6404

EUVD