CVE-2019-1000021
CVE-2019-1000021 is a high-severity vulnerability in Slixmpp Project Slixmpp with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v2: 5.0
- EPSS exploit prediction: 2% (81st percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Slixmpp Project Slixmpp
- Published:
- Last modified:
Description
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
Frequently asked questions
- What is CVE-2019-1000021?
- slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
- How severe is CVE-2019-1000021?
- CVE-2019-1000021 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2019-1000021 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (81st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-1000021?
- CVE-2019-1000021 affects Slixmpp Project Slixmpp. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2019-1000021?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2019-1000021 published?
- CVE-2019-1000021 was published on 2019-02-04 and last updated on 2026-06-17.
References
- https://lab.louiz.org/poezio/slixmpp/commit/7cd73b594e8122dddf847953fcfc85ab4d316416
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GKBXN7EAAR7ENEZUBKV6C6MP6QBXYTWT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WIBP4LD2V4TBJSLZXDUAGQMD6CUI2TZR/
- https://xmpp.org/extensions/xep-0223.html#howitworks
Affected products (1)
- cpe:2.3:a:slixmpp_project:slixmpp:*:*:*:*:*:*:*:*
More vulnerabilities in Slixmpp Project Slixmpp
- CVE-2022-45197 — High (CVSS 7.5): Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server…
- CVE-2017-5591 — Medium (CVSS 5.9): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to…