CVE-2021-37601 Information disclosure in n/a
Remote attackers can obtain sensitive Multi-User chat room membership details in common Prosody configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-37601?
CVE-2021-37601 is a high-severity vulnerability in n/a, published on 28 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
Which versions are affected by CVE-2021-37601?
It affects 1 product.
Linux distribution packages (2)
prosody SUSE:Package Hub 15 SP3 | All versions | 0.11.10-bp153.2.6.2 |
prosody openSUSE:Leap 15.3 | All versions | 0.11.10-bp153.2.6.2 |
Products include Prosody Prosody.
How do I fix CVE-2021-37601?
Upgrade to a fixed version.
Is CVE-2021-37601 being exploited?
There is no known exploitation of CVE-2021-37601 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2021-37601, GHSA-h6g2-mc2x-j8wm, UBUNTU-CVE-2021-37601, openSUSE-SU-2021:1173-1.