{"id":"CVE-2017-5606","aliases":["EUVD-2017-14704","GHSA-gchp-x69g-3q35"],"status":"published","title":"An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a...","description":"An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android).","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00783,"percentile":0.56293,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-346"],"published":"2017-02-09T20:00:00Z","modified":"2026-10-24T10:31:05Z","products":[{"vendor":"xabber","product":"xabber"}],"references":[{"url":"http://openwall.com/lists/oss-security/2017/02/09/29","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"http://www.securityfocus.com/bid/96186","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence"]},{"url":"https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5606"},{"url":"https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons"},{"url":"https://github.com/advisories/GHSA-gchp-x69g-3q35"}],"sources":{"cve":[{"id":"CVE-2017-5606","description":"An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android).","status":"published","published":"2017-02-09T20:00:00Z","modified":"2024-08-05T15:04:15.481Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14704","description":"An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android).","status":"published","published":"2017-02-09T20:00:00Z","modified":"2024-08-05T15:04:15Z","updated_at":"2026-11-03T02:39:14.545495Z"}],"ghsa":[{"id":"GHSA-gchp-x69g-3q35","title":"An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a...","description":"An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android).","status":"published","published":"2022-05-13T01:28:46Z","modified":"2025-04-20T03:33:44Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:40.757238Z"}],"nvd":[{"id":"CVE-2017-5606","description":"An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android).","status":"published","published":"2017-02-09T20:59:00.527Z","modified":"2026-06-17T01:20:49.893Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-346"],"updated_at":"2026-11-02T14:03:42.372487Z"}],"osv":[{"id":"CVE-2017-5606","description":"An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android).","status":"published","published":"2017-02-09T20:59:00.527Z","modified":"2026-10-24T10:31:05.181728533Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.029968Z"}]}}