{"id":"CVE-2022-39835","aliases":["DEBIAN-CVE-2022-39835","EUVD-2022-42280","GHSA-q3pp-76rw-fqvm","UBUNTU-CVE-2022-39835","openSUSE-SU-2024:12354-1"],"status":"published","title":"An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted...","description":"An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00559,"percentile":0.46806,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2022-09-27T18:21:13Z","modified":"2026-10-15T08:02:41Z","fixes":[{"ecosystem":"Debian:12","package":"gajim","fixed_in":["1.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gajim","fixed_in":["1.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gajim","fixed_in":["1.5.0-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gajim","fixed_in":["1.5.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gajim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gajim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gajim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gajim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16-1","0.16.5-0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gajim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.8-3","0.16.8-5","1.0.0~alpha1-1","1.0.0~alpha2-1","1.0.0~alpha3-1","1.0.0~beta1-1","1.0.0~beta2-1","1.0.0-1","1.0.1-2","1.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gajim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gajim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-2","1.3.3-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gajim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-1.1"}]}]}],"products":[{"vendor":"gajim","product":"gajim"}],"references":[{"url":"https://dev.gajim.org/gajim/gajim/-/tags","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://dev.gajim.org/gajim/gajim/-/blob/master/ChangeLog","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39835"},{"url":"https://github.com/advisories/GHSA-q3pp-76rw-fqvm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-39835","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-39835","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39835","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-39835","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-39835","description":"An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.","status":"published","published":"2022-09-27T18:21:13Z","modified":"2025-05-21T15:24:58.278Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-42280","description":"An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.","status":"published","published":"2022-09-27T18:21:13Z","modified":"2025-05-21T15:24:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:41.46277Z"}],"ghsa":[{"id":"GHSA-q3pp-76rw-fqvm","title":"An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted...","description":"An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat.","status":"published","published":"2022-09-28T00:00:16Z","modified":"2025-05-21T18:34:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:02:23.604118Z"}],"nvd":[{"id":"CVE-2022-39835","description":"An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.","status":"published","published":"2022-09-27T23:15:15.487Z","modified":"2026-06-17T04:58:24.09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"CVE-2022-39835","description":"An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.","status":"published","published":"2022-09-27T23:15:15.487Z","modified":"2026-03-14T11:52:35.161772Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"DEBIAN-CVE-2022-39835","description":"An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.","status":"published","published":"2022-09-27T23:15:15.487Z","modified":"2026-11-03T08:02:24.459826034Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"UBUNTU-CVE-2022-39835","description":"An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.","status":"published","published":"2022-09-27T23:15:00Z","modified":"2025-10-24T04:53:50Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"openSUSE-SU-2024:12354-1","title":"gajim-1.5.1-1.1 on GA media","description":"These are all security issues fixed in the gajim-1.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:10.791308Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}