CVE-2017-5591

PoC ×3—

CVSS 3.1

5.9 medium

EPSS

2%p76

Published

Feb 9, 2017 (Feb 9, 2017)

Modified

Jun 17, 2026

Description

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.

Vendors: sleekxmpp project slixmpp project poezio
Products: sleekxmpp, slixmpp, poezio
Weakness: CWE-20, CWE-346
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news0 stories

No ingested article mentions this CVE yet.