CVE-2020-26547

Published February 1st, 2021

View on NVD ↗

CVSS v3

9.8

CRITICAL

CVSS v2

MEDIUM

Affected

PROJECT

Description

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results. This allows a remote attacker (able to send stanzas to a victim) to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim.

anurodhp/VaxProj

A fork of Monal for a specific project. Use the real Monal repo for actual Monal.

GitHub