PatchSiren

Psi Plus CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Psi Plus CVE published 2017-02-09

CVE-2017-5593

CVE-2017-5593 is an XMPP client integrity issue in Psi+ where an incorrect implementation of XEP-0280 Message Carbons can let a remote attacker appear as another user in the application display. The practical impact is social engineering: a victim may trust a message or sender identity that was spoofed in the UI. NVD assigns CVSS 3.0 5.9 (Medium) and lists affected Psi+ versions 0.16.563.580 through 0.16.571.627.