Back to feed
EUVD-2014-2771 · Published Apr 11, 2014
plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.
Technologies
Prosody ProsodyLightwitch Metronome
Weaknesses
CWE-20
CVSS scores
- v2.07.8
AV:N/AC:L/Au:N/C:N/I:N/A:C
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
Potentially impacted assets
See if this affects your attack surface
