Medium severity4.2NVD Advisory· Published Jul 30, 2018· Updated Jun 17, 2026

CVE-2018-10847

Description

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Prosody/Prosody4 versions
cpe:2.3:a:prosody:prosody:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:prosody:prosody:*:*:*:*:*:*:*:*range: <0.9.14
- cpe:2.3:a:prosody:prosody:0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:prosody:prosody:0.10.1:*:*:*:*:*:*:*
- (no CPE)range: <0.9.14, <0.10.2

Patches

Vulnerability mechanics

References

blog.prosody.im/prosody-0-10-2-security-release/nvdVendor Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
issues.prosody.im/1147nvdVendor Advisory
prosody.im/security/advisory_20180531/nvdVendor Advisory
www.debian.org/security/2018/dsa-4216nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.273
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000