Read the docs
TI-2012-03053 Aliases CVE-2012-3525GHSA-f2gg-g599-6m5f

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an…

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

Why it matters now

EPSS 0.0173 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:jabber2:jabberd2:2.1.19:*:*:*:*:*:*:*2.1.19VulnerableJabber2
cpe:2.3:a:jabberd2:jabberd2:*:*:*:*:*:*:*:*up to 2.2.16VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1:*:*:*:*:*:*:*2.1VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.2:*:*:*:*:*:*:*2.1.2VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.3:*:*:*:*:*:*:*2.1.3VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.4:*:*:*:*:*:*:*2.1.4VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.5:*:*:*:*:*:*:*2.1.5VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.6:*:*:*:*:*:*:*2.1.6VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.7:*:*:*:*:*:*:*2.1.7VulnerableJabberd2
  • cpe:2.3:a:jabber2:jabberd2:2.1.19:*:*:*:*:*:*:* Versions 2.1.19 Vulnerable ·Jabber2
  • cpe:2.3:a:jabberd2:jabberd2:*:*:*:*:*:*:*:* Versions up to 2.2.16 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.5:*:*:*:*:*:*:* Versions 2.1.5 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.6:*:*:*:*:*:*:* Versions 2.1.6 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.7:*:*:*:*:*:*:* Versions 2.1.7 Vulnerable ·Jabberd2
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:jabberd2:jabberd2:2.1.8:*:*:*:*:*:*:*2.1.8VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.9:*:*:*:*:*:*:*2.1.9VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.10:*:*:*:*:*:*:*2.1.10VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.11:*:*:*:*:*:*:*2.1.11VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.12:*:*:*:*:*:*:*2.1.12VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.13:*:*:*:*:*:*:*2.1.13VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.14:*:*:*:*:*:*:*2.1.14VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.15:*:*:*:*:*:*:*2.1.15VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.16:*:*:*:*:*:*:*2.1.16VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.17:*:*:*:*:*:*:*2.1.17VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.18:*:*:*:*:*:*:*2.1.18VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.20:*:*:*:*:*:*:*2.1.20VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.21:*:*:*:*:*:*:*2.1.21VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.22:*:*:*:*:*:*:*2.1.22VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.23:*:*:*:*:*:*:*2.1.23VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.1.24:*:*:*:*:*:*:*2.1.24VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.5:*:*:*:*:*:*:*2.2.5VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.6:*:*:*:*:*:*:*2.2.6VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.7:*:*:*:*:*:*:*2.2.7VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.7.1:*:*:*:*:*:*:*2.2.7.1VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.8:*:*:*:*:*:*:*2.2.8VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.9:*:*:*:*:*:*:*2.2.9VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.10:*:*:*:*:*:*:*2.2.10VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.11:*:*:*:*:*:*:*2.2.11VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.12:*:*:*:*:*:*:*2.2.12VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.13:*:*:*:*:*:*:*2.2.13VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.14:*:*:*:*:*:*:*2.2.14VulnerableJabberd2
cpe:2.3:a:jabberd2:jabberd2:2.2.15:*:*:*:*:*:*:*2.2.15VulnerableJabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.8:*:*:*:*:*:*:* Versions 2.1.8 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.9:*:*:*:*:*:*:* Versions 2.1.9 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.10:*:*:*:*:*:*:* Versions 2.1.10 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.11:*:*:*:*:*:*:* Versions 2.1.11 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.12:*:*:*:*:*:*:* Versions 2.1.12 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.13:*:*:*:*:*:*:* Versions 2.1.13 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.14:*:*:*:*:*:*:* Versions 2.1.14 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.15:*:*:*:*:*:*:* Versions 2.1.15 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.16:*:*:*:*:*:*:* Versions 2.1.16 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.17:*:*:*:*:*:*:* Versions 2.1.17 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.18:*:*:*:*:*:*:* Versions 2.1.18 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.20:*:*:*:*:*:*:* Versions 2.1.20 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.21:*:*:*:*:*:*:* Versions 2.1.21 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.22:*:*:*:*:*:*:* Versions 2.1.22 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.23:*:*:*:*:*:*:* Versions 2.1.23 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.1.24:*:*:*:*:*:*:* Versions 2.1.24 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.7.1:*:*:*:*:*:*:* Versions 2.2.7.1 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.10:*:*:*:*:*:*:* Versions 2.2.10 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.11:*:*:*:*:*:*:* Versions 2.2.11 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.12:*:*:*:*:*:*:* Versions 2.2.12 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.13:*:*:*:*:*:*:* Versions 2.2.13 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.14:*:*:*:*:*:*:* Versions 2.2.14 Vulnerable ·Jabberd2
  • cpe:2.3:a:jabberd2:jabberd2:2.2.15:*:*:*:*:*:*:* Versions 2.2.15 Vulnerable ·Jabberd2

Remediation

Red Hat 2 advisories

  • RHSA-2012:1539 Released 2012-12-04 · Red Hat rating Low
    Red Hat Network Proxy server jabberd security update
    • Red Hat Satellite Proxy 5.5 (RHEL v.5) jabberd-2.2.8-20.el5sat
    • Red Hat Satellite Proxy 5.5 (RHEL v.6) jabberd-2.2.8-20.el6sat
  • RHSA-2012:1538 Released 2012-12-04 · Red Hat rating Low
    Red Hat Network Satellite server jabberd security update
    • Red Hat Satellite 5.5 (RHEL v.5) jabberd-2.2.8-20.el5sat
    • Red Hat Satellite 5.5 (RHEL v.6) jabberd-2.2.8-20.el6sat

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 5.5 (RHEL v.5)Fixed RHSA-2012:1538
Red Hat Satellite 5.5 (RHEL v.6)Fixed RHSA-2012:1538
Red Hat Satellite Proxy 5.5 (RHEL v.5)Fixed RHSA-2012:1539
Red Hat Satellite Proxy 5.5 (RHEL v.6)Fixed RHSA-2012:1539

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-3525
  2. 2026-10-03 Alias added: GHSA-f2gg-g599-6m5f

References

Exploit 1

Advisory 4

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences