7.8

CVE-2014-2744

Exploit

plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.

Data is provided by the National Vulnerability Database (NVD)
Lightwitch ≫ Metronome Version <= 3.4
Prosody ≫ Prosody Version <= 0.9.3
Prosody ≫ Prosody Version0.1.0
Prosody ≫ Prosody Version0.2.0
Prosody ≫ Prosody Version0.3.0
Prosody ≫ Prosody Version0.4.0
Prosody ≫ Prosody Version0.4.1
Prosody ≫ Prosody Version0.4.2
Prosody ≫ Prosody Version0.5.0
Prosody ≫ Prosody Version0.5.1
Prosody ≫ Prosody Version0.5.2
Prosody ≫ Prosody Version0.6.0
Prosody ≫ Prosody Version0.6.1
Prosody ≫ Prosody Version0.6.2
Prosody ≫ Prosody Version0.7.0
Prosody ≫ Prosody Version0.8.0
Prosody ≫ Prosody Version0.8.1
Prosody ≫ Prosody Version0.8.2
Prosody ≫ Prosody Version0.9.0
Prosody ≫ Prosody Version0.9.1
Prosody ≫ Prosody Version0.9.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 2.18% 0.838
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:N/I:N/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.