Prosody
Products by Prosody Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2024 there have been 0 vulnerabilities in Prosody . Prosody did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 7.50 |
| 2021 | 4 | 6.95 |
| 2020 | 1 | 9.80 |
| 2019 | 0 | 0.00 |
| 2018 | 1 | 8.80 |
It may take a day or so for new Prosody vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Prosody Security Vulnerabilities
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features
CVE-2022-0217
7.5 - High
- August 26, 2022
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
XXE
muc.lib.lua in Prosody 0.11.0 through 0.11.9
CVE-2021-37601
7.5 - High
- July 30, 2021
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
Prosody before 0.11.9
CVE-2021-32920
7.5 - High
- May 13, 2021
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.
An issue was discovered in Prosody before 0.11.9
CVE-2021-32919
7.5 - High
- May 13, 2021
An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impersonate another server (when this option is enabled).
Improper Certificate Validation
An issue was discovered in Prosody before 0.11.9
CVE-2021-32917
5.3 - Medium
- May 13, 2021
An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.
AuthZ
The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function
CVE-2020-8086
9.8 - Critical
- January 28, 2020
The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. This grants remote entities admin-only functionality if their username matches the username of a local admin.
AuthZ
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass
CVE-2018-10847
8.8 - High
- July 30, 2018
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.
authentification