CVE-2017-5606

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android).

• CWE-20
• CWE-346

• http://openwall.com/lists/oss-security/2017/02/09/29Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/96186Third Party Advisory, VDB Entry
• https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/Exploit, Technical Description, Third Party Advisory
• https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdfExploit, Technical Description, Third Party Advisory
• http://openwall.com/lists/oss-security/2017/02/09/29Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/96186Third Party Advisory, VDB Entry
• https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/Exploit, Technical Description, Third Party Advisory
• https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdfExploit, Technical Description, Third Party Advisory

Published

Feb 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5600The Data Warehouse component in NetApp OnCommand Insight bef…
• CVE-2017-5601An error in the lha_read_file_header_1() function (archive_r…
• CVE-2017-5602An incorrect implementation of "XEP-0280: Message Carbons" i…
• CVE-2017-5603An incorrect implementation of "XEP-0280: Message Carbons" i…
• CVE-2017-5604An incorrect implementation of "XEP-0280: Message Carbons" i…
• CVE-2017-5605An incorrect implementation of "XEP-0280: Message Carbons" i…
• CVE-2017-5607Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, …
• CVE-2017-5608Cross-site scripting (XSS) vulnerability in the image upload…
• CVE-2017-5609SQL injection vulnerability in include/functions_entries.inc…
• CVE-2017-5610wp-admin/includes/class-wp-press-this.php in Press This in W…
• CVE-2017-5611SQL injection vulnerability in wp-includes/class-wp-query.ph…9.8
• CVE-2017-5612Cross-site scripting (XSS) vulnerability in wp-admin/include…