Description
Versions of converse.js prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of XEP-0280: Message Carbons that allows a remote attacker to impersonate any user, including contacts, in the vulnerable application’s display.
Recommendation
Update the converse.js package to the latest compatible version. Followings are version details:
Affected version(s): **>= 2.0.0, < 2.0.5 < 1.0.7** Patched version(s): **2.0.5 1.0.7**
References
Could your website be exposed too?
SmartScanner can check your website for User Impersonation in converse.js and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Converse.js Exposure of Sensitive Information - CVE-2018-6591
- mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input - CVE-2017-16138
- matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification - CVE-2022-39250
- matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion - CVE-2022-39251
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023