CVE-2015-8688 Missing authorization in n/a

Medium 5.4 Published 15 Jan 2016 Updated 6 Aug 2024

Remote attackers can modify the contact roster and intercept messages in Gajim by sending a crafted IQ stanza.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2015-8688?

CVE-2015-8688 is a medium-severity missing authorization vulnerability in n/a, published on 15 Jan 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ stanza.

Weakness: CWE-20

Which versions are affected by CVE-2015-8688?

It affects 1 product.

Linux distribution packages (1)

mcabber openSUSE:Tumbleweed All versions 1.0.4-1.1

Products include Gajim Gajim.

How do I fix CVE-2015-8688?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2015-8688 being exploited?

There is no known exploitation of CVE-2015-8688 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2015-8688, DLA-413-1, DSA-3492-1, GHSA-fg7g-52r5-p6wj, MGASA-2016-0046, openSUSE-SU-2024:10007-1.