CVE-2013-6404
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID...
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
Exploit likelihood
What each source reports
NVD Score used
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
- Record
CVE-2013-6404- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
- Record
CVE-2013-6404- Updated
- 2026-11-02
EUVDEUVD-2013-6225 No score
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
- Record
EUVD-2013-6225- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pvv4-25p8-vqx8 No score
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID...
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
- Record
GHSA-pvv4-25p8-vqx8- Updated
- 2026-11-02
OSV No score
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
- Record
CVE-2013-6404- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6404 No score
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
- Record
DEBIAN-CVE-2013-6404- Updated
- 2026-11-02
OSVMGASA-2013-0362 No score
Updated quassel package fixes security vulnerability
Security vulnerability in Quassel before 0.9.2 through which a manipulated, but properly authenticated client was able to retrieve the backlog of other users on the same core in some cases (CVE-2013-6404).
- Record
MGASA-2013-0362- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6404 is a medium vulnerability (CVSS 4.0) in Quassel-irc Quassel Irc, published November 30, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.06%, the 81st percentile. Fixed in quassel 0.9.2-1.
References
github.com/quassel/quassel/commit/a1a24da
lists.opensuse.org/opensuse-updates/2013-12/msg00092.html
openwall.com/lists/oss-security/2013/11/28/8
quassel-irc.org/node/123
exchange.xforce.ibmcloud.com/vulnerabilities/89377
secunia.com/advisories/55640
Show 8 moreShow less
osvdb.org/100432
nvd.nist.gov/vuln/detail/CVE-2013-6404
security-tracker.debian.org/tracker/CVE-2013-6404
advisories.mageia.org/MGASA-2013-0362.html
bugs.mageia.org/show_bug.cgi?id=11808
freecode.com/projects/quassel/releases/359566