Skip to content

CVE-2014-8760

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used,...

5.0 MediumFix available

CVE-2014-8760 is a medium vulnerability (CVSS 5.0) in Process-one Ejabberd, published October 23, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in ejabberd 14.07-3.

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Exploit likelihood

1.31%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: CVE-2014-8760
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: CVE-2014-8760
Updated: 2026-11-02

EUVDEUVD-2014-8591 No score

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: EUVD-2014-8591
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p3cj-xwxg-f4p3 No score

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used,...

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: GHSA-p3cj-xwxg-f4p3
Updated: 2026-11-02

OSV No score

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: CVE-2014-8760
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-8760 No score

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: DEBIAN-CVE-2014-8760
Updated: 2026-11-02

OSVMGASA-2014-0417 No score

Updated ejabberd packages fix security vulnerability

A flaw was discovered in ejabberd that allows clients to connect with an unencrypted connection even if starttls_required is set (CVE-2014-8760).

Record: MGASA-2014-0417
Updated: 2026-11-02

Affected products

process-one ejabberd

Affected packages

Affected packages
Package	Affected	Fixed
`ejabberd` Debian:12	before 14.07-3	14.07-3
`ejabberd` Debian:13	before 14.07-3	14.07-3
`ejabberd` Debian:14	before 14.07-3	14.07-3
`ejabberd` Debian:7	before 2.1.10-4+deb7u2, plus listed versions 2.1.10-42.1.10-4+deb7u1	2.1.10-4+deb7u2
`ejabberd` Mageia:3	before 2.1.13-1.1.mga3	2.1.13-1.1.mga3
`ejabberd` Mageia:4	before 2.1.13-3.1.mga4	2.1.13-3.1.mga4

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 7 moreShow less