CVE-2020-26547 | BDVDB-2026-148366 Detail

Description#

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results. This allows a remote attacker (able to send stanzas to a victim) to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/anurodhp/Monal/commits/develop
https://monal.im/blog/cve-2020-26547/

Exploit#

No public exploit known

History#

Version 12021-02-01Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.