CVE-2014-2829

Severity Score

7.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.

Erlang Solutions MongooseIM hasta 1.3.1 rev. 2 no restringe debidamente el procesamiento de elementos XML comprimidos, lo que permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de una cadena XMPP manipulada, también conocido como un ataque "xmppbomb".

*Credits: N/A

CVSS Scores

NISTv2 7.8

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-04-10 CVE Reserved
2014-04-11 CVE Published
2024-09-17 CVE Updated
2024-09-17 EPSS Updated
2024-09-17 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (2)

URL	Tag	Source
http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas	X_refsource_misc

URL	Date	SRC
https://github.com/esl/MongooseIM/commit/586d96cc12ef218243a3466354b4d208b5472a6c	2024-09-17

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Erlang-solutions Search vendor "Erlang-solutions"		Mongooseim Search vendor "Erlang-solutions" for product "Mongooseim"				<= 1.3.1 Search vendor "Erlang-solutions" for product "Mongooseim" and version " <= 1.3.1"		rev2		Affected
Erlang-solutions Search vendor "Erlang-solutions"		Mongooseim Search vendor "Erlang-solutions" for product "Mongooseim"				1.2.1 Search vendor "Erlang-solutions" for product "Mongooseim" and version "1.2.1"		-		Affected
Erlang-solutions Search vendor "Erlang-solutions"		Mongooseim Search vendor "Erlang-solutions" for product "Mongooseim"				1.2.2 Search vendor "Erlang-solutions" for product "Mongooseim" and version "1.2.2"		-		Affected
Erlang-solutions Search vendor "Erlang-solutions"		Mongooseim Search vendor "Erlang-solutions" for product "Mongooseim"				1.3.0 Search vendor "Erlang-solutions" for product "Mongooseim" and version "1.3.0"		-		Affected
Erlang-solutions Search vendor "Erlang-solutions"		Mongooseim Search vendor "Erlang-solutions" for product "Mongooseim"				1.3.1 Search vendor "Erlang-solutions" for product "Mongooseim" and version "1.3.1"		-		Affected