Every CVE Search/ Get API key

CVE-2012-3525

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP...

5.8 MediumFix available

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

Exploit likelihood

1.73%Up 0.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.8

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

Record
CVE-2012-3525
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

Record
CVE-2012-3525
Updated
2026-11-02
EUVDEUVD-2012-3480 No score

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

Record
EUVD-2012-3480
Updated
2026-11-03
GitHub AdvisoriesGHSA-f2gg-g599-6m5f No score

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP...

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

Record
GHSA-f2gg-g599-6m5f
Weakness
CWE-20
Updated
2026-11-02
OSV No score

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

Record
CVE-2012-3525
Updated
2026-11-02
OSVDEBIAN-CVE-2012-3525 No score

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

Record
DEBIAN-CVE-2012-3525
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jabberd2
Debian:12
 before 2.2.17-1
2.2.17-1
jabberd2
Debian:13
 before 2.2.17-1
2.2.17-1
jabberd2
Debian:14
 before 2.2.17-1
2.2.17-1
jabberd
Red Hat:network_satellite:5.5::el5
 before 0:2.2.8-20.el5sat
0:2.2.8-20.el5sat
jabberd-debuginfo
Red Hat:network_satellite:5.5::el5
 before 0:2.2.8-20.el5sat
0:2.2.8-20.el5sat
jabberd
Red Hat:network_satellite:5.5::el6
 before 0:2.2.8-20.el6sat
0:2.2.8-20.el6sat
jabberd-debuginfo
Red Hat:network_satellite:5.5::el6
 before 0:2.2.8-20.el6sat
0:2.2.8-20.el6sat
jabberd
Red Hat:network_proxy:5.5::el5
 before 0:2.2.8-20.el5sat
0:2.2.8-20.el5sat
jabberd-debuginfo
Red Hat:network_proxy:5.5::el5
 before 0:2.2.8-20.el5sat
0:2.2.8-20.el5sat
jabberd
Red Hat:network_proxy:5.5::el6
 before 0:2.2.8-20.el6sat
0:2.2.8-20.el6sat
jabberd-debuginfo
Red Hat:network_proxy:5.5::el6
 before 0:2.2.8-20.el6sat
0:2.2.8-20.el6sat

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-3525 is a medium vulnerability (CVSS 5.8) in Jabber2 Jabberd2, published August 25, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.73%, the 77th percentile. Fixed in jabberd2 2.2.17-1.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open