CVE-2022-24968

In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their…

published February 11, 2022

CVSS
—
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00539 · 44.6th percentile
Published
2022-02-11T18:16Z
EPSS history
Timeline
  • 11 FEB 18:16Z
    In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their…
    cvelistv5