CVE-2021-37601
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive...
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
- Record
CVE-2021-37601- CVSS 3.1
- 7.5 High
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2021-24159
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
- Record
EUVD-2021-24159- CVSS 3.1
- 7.5 High
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h6g2-mc2x-j8wm
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive...
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
- Record
GHSA-h6g2-mc2x-j8wm- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
NVD
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
- Record
CVE-2021-37601- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
OSVALPINE-CVE-2021-37601
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
- Record
ALPINE-CVE-2021-37601- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
- Record
CVE-2021-37601- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2021-37601
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
- Record
DEBIAN-CVE-2021-37601- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-37601
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
- Record
UBUNTU-CVE-2021-37601- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1173-1 No score
Security update for prosody
This update for prosody fixes the following issues:
prosody was updated to 0.11.10:
Security:
-
MUC: Fix logic for access to affiliation lists CVE-2021-37601 (boo#1188976)
Minor changes:
- prosodyctl: Add ‘limits’ to known globals to warn about misplacing it
- util.ip: Fix netmask for link-local address range
- mod_pep: Remove obsolete node restoration code
- util.pubsub: Fix traceback if node data not initialized
- Record
openSUSE-SU-2021:1173-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11197-1 No score
prosody-0.11.10-1.2 on GA media
These are all security issues fixed in the prosody-0.11.10-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11197-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prosodyAlpine:v3.14 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
prosodyAlpine:v3.15 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
prosodyAlpine:v3.16 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
prosodyAlpine:v3.17 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
prosodyAlpine:v3.18 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
prosodyAlpine:v3.19 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
prosodyAlpine:v3.20 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
prosodyAlpine:v3.21 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
prosodyAlpine:v3.22 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
prosodyAlpine:v3.23 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
prosodyAlpine:v3.24 |
0.11.0 up to 0.11.10-r0 | 0.11.10-r0 |
prosodyDebian:12 |
before 0.11.9-2 | 0.11.9-2 |
prosodyDebian:13 |
before 0.11.9-2 | 0.11.9-2 |
prosodyDebian:14 |
before 0.11.9-2 | 0.11.9-2 |
prosodyUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.8-10.9.9-10.9.10-1 |
None known |
prosodyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.9.12-20.10.0-10.10.0-1build10.10.0-1ubuntu0.1~esm1 |
None known |
prosodyUbuntu:20.04:LTS |
All versions, plus listed versions 0.11.2-10.11.3-10.11.4-1 |
None known |
prosodySUSE:Package Hub 15 SP3 |
before 0.11.10-bp153.2.6.2 | 0.11.10-bp153.2.6.2 |
prosodyopenSUSE:Leap 15.3 |
before 0.11.10-bp153.2.6.2 | 0.11.10-bp153.2.6.2 |
prosodyopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 0.11.10-1.2 | 0.11.10-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37601 is a high vulnerability (CVSS 7.5) in Prosody, published July 28, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile. Fixed in prosody 0.11.10-r0.
References
prosody.im/security/advisory_20210722
openwall.com/lists/oss-security/2021/07/28/4
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMKIOEP2CYWHVVUCNWISPE4AGH4IR7O2
nvd.nist.gov/vuln/detail/CVE-2021-37601
Show 14 moreShow less
github.com/advisories/GHSA-h6g2-mc2x-j8wm
security.alpinelinux.org/vuln/CVE-2021-37601
security-tracker.debian.org/tracker/CVE-2021-37601
ubuntu.com/security/CVE-2021-37601
cve.org/CVERecord?id=CVE-2021-37601
lists.opensuse.org/archives/list/[email protected]/thread/AFQIQ2726F5P4HAPY7BLDPPFSDMPRVNM
bugzilla.suse.com/1188976
suse.com/security/cve/CVE-2021-37601