NVD

Id
41462  
Name
CVE-2013-6404  
Description
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users" backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2013-12-09  
Modified Date
2014-03-05  
Seq
2013-6404  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
209483 41462 CVE-2013-6404 openSUSE-SU-2013:1929  View
209484 41462 CVE-2013-6404 openSUSE-SU-2014:0114  View
209485 41462 CVE-2013-6404 http://quassel-irc.org/node/123  View
209486 41462 CVE-2013-6404 [oss-security] 20131127 Re: CVE Request: Quassel IRC - manipulated clients can access backlog of all users on a shared core  View
209487 41462 CVE-2013-6404 quasselirc-cve20136404-sec-bypass(89377)  View
209488 41462 CVE-2013-6404 https://github.com/quassel/quassel/commit/a1a24da  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
23873 JVNDB-2013-005448 Quassel IRC の Quassel core における他のユーザのバックログを読まれる脆弱性 Quassel IRC の Quassel core (サーバデーモン) は、ユーザバックログへのアクセス時にユーザ ID を適切に検証しないため、他のユーザのバックログを読まれる脆弱性が存在します。 CVE-2013-6404 66346 CVE-2013-6404 41462 4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005448.html 2013-11-26 2013-12-11 View