PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9107 Otr CVE debrief

CVE-2016-9107 is an information-disclosure issue in the OTR plugin for Gajim. When XHTML is used, the plugin can send information in cleartext, which can expose sensitive data to a remote attacker. NVD rates the issue HIGH, with a network-reachable attack path and no privileges or user interaction required.

Vendor
Otr
Product
Gajim-Otr
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-13
Original CVE updated
2026-05-13
Advisory published
2017-01-13
Advisory updated
2026-05-13

Who should care

Anyone running Gajim with the OTR plugin enabled, especially environments where XHTML messaging is used or where chat content may include sensitive information. Security teams supporting end users, messaging infrastructure, or privacy-sensitive communications should prioritize review.

Technical summary

NVD maps this issue to CWE-200 and lists the vulnerable CPE as cpe:2.3:a:otr:gajim-otr:-:*:*:*:*:*:*:*. The published CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which indicates remote, unauthenticated exposure of confidential data without integrity or availability impact. The source description attributes the leak to cleartext transmission when XHTML is used.

Defensive priority

High: this is a remote confidentiality issue with no authentication or user interaction required, and the published CVSS score is 7.5.

Recommended defensive actions

  • Check whether Gajim's OTR plugin is installed and whether XHTML features are enabled or used in your deployment.
  • Apply the upstream fix referenced by the project issue tracker and related changeset, or update to a release that includes the patch.
  • If immediate patching is not possible, disable or avoid XHTML use in affected workflows to reduce exposure.
  • Assume sensitive content handled through the affected path may have been exposed and review whether additional operational response is needed.
  • Use the official CVE and NVD records, plus the project references, to confirm the applicable remediated build for your environment.

Evidence notes

The vulnerability description states that the OTR plugin for Gajim sends information in cleartext when using XHTML, allowing remote attackers to obtain sensitive information via unspecified vectors. NVD supplies the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and CWE-200. The reference set includes oss-security mailing-list posts dated 2016-10-30, SecurityFocus BID 94099, Gajim issue 145, and a related changeset, which together support the public disclosure and patch trail.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9107 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9107

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9107 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9107

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.