CVE-2012-4670

Published: Aug 25, 2012Modified: Apr 29, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

Tigase XMPP Server before 5.1.0 does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

Affected (1)

Products: Tigase: Tigase Xmpp Server

Tigase

1 product

Tigase Xmpp Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tigase Tigase Xmpp Server	Up to 5.1.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

http://www.tigase.org/content/finally-version-510-final-available

Source: cve@mitre.org

http://xmpp.org/resources/security-notices/server-dialback/

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/77985

Source: cve@mitre.org

https://projects.tigase.org/projects/tigase-server/repository/revisions/2953/diff

Source: cve@mitre.org

http://www.tigase.org/content/finally-version-510-final-available

Source: af854a3a-2127-422b-91ae-364da2661108

http://xmpp.org/resources/security-notices/server-dialback/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/77985

Source: af854a3a-2127-422b-91ae-364da2661108

https://projects.tigase.org/projects/tigase-server/repository/revisions/2953/diff

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.