CVE-2014-8760

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used,...

5.0 MediumFix available

CVE-2014-8760 is a medium vulnerability (CVSS 5.0) in Process-one Ejabberd, published October 23, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 71st percentile. Fixed in ejabberd 14.07-3.

What does this mean?

Severity: 5.0 MediumCVSS 2.0, NVD
Exploit chance: 1.31%EPSS, 71st percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 14.07-3ejabberd +5 more

Description

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Exploit likelihood

1.31%Up 0.1 points since Feb 4, 2022

Affected products

process-one ejabberd

Affected packages

Affected packages
Package	Affected	Fixed
`ejabberd` Debian:12	before 14.07-3	14.07-3
`ejabberd` Debian:13	before 14.07-3	14.07-3
`ejabberd` Debian:14	before 14.07-3	14.07-3
`ejabberd` Debian:7	before 2.1.10-4+deb7u2, plus listed versions 2.1.10-42.1.10-4+deb7u1	2.1.10-4+deb7u2
`ejabberd` Mageia:3	before 2.1.13-1.1.mga3	2.1.13-1.1.mga3
`ejabberd` Mageia:4	before 2.1.13-3.1.mga4	2.1.13-3.1.mga4

What each source reports

NVD Score used5.0

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: CVE-2014-8760
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-310
Updated: 2026-11-02

CVE ListNo score

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: CVE-2014-8760
Updated: 2026-11-02

EUVDEUVD-2014-8591No score

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: EUVD-2014-8591
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p3cj-xwxg-f4p3No score

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used,...

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: GHSA-p3cj-xwxg-f4p3
Updated: 2026-11-02

OSVNo score

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: CVE-2014-8760
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-8760No score

ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.

Record: DEBIAN-CVE-2014-8760
Updated: 2026-11-02

OSVMGASA-2014-0417No score

Updated ejabberd packages fix security vulnerability

A flaw was discovered in ejabberd that allows clients to connect with an unencrypted connection even if starttls_required is set (CVE-2014-8760).

Record: MGASA-2014-0417
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 10, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 7 moreShow less