{"id":"CVE-2013-6404","aliases":["DEBIAN-CVE-2013-6404","EUVD-2013-6225","GHSA-pvv4-25p8-vqx8","MGASA-2013-0362"],"status":"published","title":"Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID...","description":"Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02059,"percentile":0.8145,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-11-30T21:42:15Z","modified":"2026-09-01T20:02:13Z","fixes":[{"ecosystem":"Debian:12","package":"quassel","fixed_in":["0.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"quassel","fixed_in":["0.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"quassel","fixed_in":["0.9.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"quassel","fixed_in":["0.9.2-1.mga3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"quassel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"quassel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"quassel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"quassel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-1.mga3"}]}]}],"products":[{"vendor":"quassel-irc","product":"quassel_irc"}],"references":[{"url":"https://github.com/quassel/quassel/commit/a1a24da","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/11/28/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://quassel-irc.org/node/123","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89377","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://secunia.com/advisories/55640","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://osvdb.org/100432","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6404"},{"url":"https://github.com/advisories/GHSA-pvv4-25p8-vqx8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-6404","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0362.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11808","tags":["report"]},{"url":"http://freecode.com/projects/quassel/releases/359566","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-6404","description":"Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.","status":"published","published":"2013-12-09T11:00:00Z","modified":"2024-08-06T17:39:01.3Z","updated_at":"2026-11-02T14:34:57.195423Z"}],"euvd":[{"id":"EUVD-2013-6225","description":"Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.","status":"published","published":"2013-12-09T11:00:00Z","modified":"2024-08-06T17:39:01Z","updated_at":"2026-11-03T01:56:26.306678Z"}],"ghsa":[{"id":"GHSA-pvv4-25p8-vqx8","title":"Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID...","description":"Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.","status":"published","published":"2022-05-17T01:30:29Z","modified":"2023-02-03T05:04:09Z","updated_at":"2026-11-02T14:53:29.869331Z"}],"nvd":[{"id":"CVE-2013-6404","description":"Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.","status":"published","published":"2013-12-09T16:36:47.283Z","modified":"2026-06-17T00:00:25.69Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:44.596064Z"}],"osv":[{"id":"CVE-2013-6404","description":"Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.","status":"published","published":"2013-12-09T16:36:47Z","modified":"2026-04-16T06:22:51.435113515Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-6404","description":"Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.","status":"published","published":"2013-12-09T16:36:47.283Z","modified":"2026-09-01T20:02:13.96661627Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"MGASA-2013-0362","title":"Updated quassel package fixes security vulnerability","description":"Security vulnerability in Quassel before 0.9.2 through which a\nmanipulated, but   properly authenticated client was able to retrieve the\nbacklog of other users on the same core in some cases (CVE-2013-6404).\n","status":"published","published":"2013-11-30T21:42:15Z","modified":"2026-04-16T06:25:11.948266143Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}