Medium severity5.9NVD Advisory· Published Feb 9, 2017· Updated Jun 17, 2026
CVE-2017-5858
CVE-2017-5858
Description
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Converse.js (0.8.0 - 1.0.6, 2.0.0 - 2.0.4).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
converse.jsnpm | < 1.0.7 | 1.0.7 |
converse.jsnpm | >= 2.0.0, < 2.0.5 | 2.0.5 |
Affected products
29cpe:2.3:a:conversejs:converse.js:0.10.0:*:*:*:*:*:*:*+ 27 more
- cpe:2.3:a:conversejs:converse.js:0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:0.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:conversejs:converse.js:2.0.4:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
11- github.com/jcbrand/converse.js/commit/42f249cabbbf5c026398e6d3b350f6f9536ea572nvdPatchWEB
- openwall.com/lists/oss-security/2017/02/09/29nvdExploitMailing ListThird Party AdvisoryWEB
- rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/nvdExploitTechnical DescriptionThird Party Advisory
- rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdfnvdExploitTechnical DescriptionThird Party AdvisoryWEB
- github.com/advisories/GHSA-w973-2qcc-p78xghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-5858ghsaADVISORY
- www.securityfocus.com/bid/96183nvdWEB
- rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbonsghsaWEB
- snyk.io/vuln/SNYK-JS-CONVERSEJS-449664ghsaWEB
- www.npmjs.com/advisories/974ghsaWEB
- www.openwall.com/lists/oss-security/2017/02/09/29ghsaWEB
News mentions
0No linked articles in our index yet.