Open-source package vulnerability · Go
CVE-2024-46957: Mellium allows Authentication Bypass by Spoofing
criticalCVSS 4.0 9.3 · 3.1 9.8GHSA-98hf-m87w-cq6h
Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing because the stanza type is not checked. This is fixed in 0.22.0.
Published Sep 25, 2024
Affected packages
mellium.im/xmpp
- Ecosystem
- Go
- Affected
- < 0.22.0
- Fixed in
- 0.22.0
- Check
go list -m mellium.im/xmpp
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing because the stanza type is not checked. This is fixed in 0.22.0.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology