Cryptographic issues in ejabberd - CVE-2013-6169
Published: October 18, 2013 / Updated: August 10, 2020
Vulnerability identifier: #VU42460
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2013-6169
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: processone
Affected software:
ejabberd
ejabberd
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The TLS driver in ejabberd before 2.1.12 supports (1) SSLv2 and (2) weak SSL ciphers, which makes it easier for remote attackers to obtain sensitive information via a brute-force attack.
How to mitigate CVE-2013-6169
Install update from vendor's website.