Fluid Attacks Database

Description

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	prosody	>=0 <0.10.2-1	0.10.2-1
debian 13	prosody	>=0 <0.10.2-1	0.10.2-1
debian 14	prosody	>=0 <0.10.2-1	0.10.2-1

Aliases

1. CVE-2018-108472. NVD-2018-108473. OSV-DEBIAN-2018-108474. OSV-2018-108475. SECURITY-TRACKER-CVE-2018-10847

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.