Most recent entries from all

cnvd-2017-01495

EUVD-2026-73601

fkie_cve-2017-5858

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Converse.js (0.8.0 - 1.0.6, 2.0.0 - 2.0.4).

GHSA-w973-2qcc-p78x — User Impersonation in converse.js

Affected: npm: converse.js

Versions of `converse.js` prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of [XEP-0280: Message Carbons](https://xmpp.org/extensions/xep-0280.html) that allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks.

## Recommendation

If you're using `converse.js` 1.x, upgrade to 1.0.7 or later. If you're using `converse.js` 2.x, upgrade to 2.0.5 or later.

Most recent entries from all

cnvd-2017-01495

EUVD-2026-73601

fkie_cve-2017-5858

GHSA-w973-2qcc-p78x — User Impersonation in converse.js

gsd-2017-5858