{"id":"CVE-2016-0756","details":"The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.","modified":"2026-03-15T14:15:34.786602Z","published":"2016-01-29T20:59:06.560Z","related":["openSUSE-SU-2024:10489-1"],"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2016/01/27/10"},{"type":"WEB","url":"http://www.securityfocus.com/bid/82241"},{"type":"WEB","url":"https://prosody.im/issues/issue/596"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176796.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176914.html"},{"type":"ADVISORY","url":"https://prosody.im/security/advisory_20160127/"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3463"},{"type":"FIX","url":"http://blog.prosody.im/prosody-0-9-10-released/"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-0756.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"0.9.9"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}