QwikSec

Security Database

CVE

CWE

Training

CVE-2013-6404

Published: Dec 9, 2013

Modified: Aug 6, 2024

PUBLISHED

Description

Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/quassel/quassel/commit/a1a24da

x_refsource_CONFIRM

openSUSE-SU-2013:1929

vendor-advisory

x_refsource_SUSE

[oss-security] 20131127 Re: CVE Request: Quassel IRC - manipulated clients can access backlog of all users on a shared core

mailing-list

x_refsource_MLIST

http://quassel-irc.org/node/123

x_refsource_CONFIRM

quasselirc-cve20136404-sec-bypass(89377)

vdb-entry

x_refsource_XF

third-party-advisory

x_refsource_SECUNIA

openSUSE-SU-2014:0114

vendor-advisory

x_refsource_SUSE

vdb-entry

x_refsource_OSVDB

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.