CVE-2013-6404

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-12-09 · updated 2026-06-17
Weakness: CWE-264

Description

Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.

Affected products

Quassel-Irc Quassel Irc: through 0.9.1; 0.9.0

References

http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html
http://osvdb.org/100432
http://quassel-irc.org/node/123
http://secunia.com/advisories/55640
http://www.openwall.com/lists/oss-security/2013/11/28/8
https://exchange.xforce.ibmcloud.com/vulnerabilities/89377
https://github.com/quassel/quassel/commit/a1a24da
http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html
http://osvdb.org/100432
http://quassel-irc.org/node/123

Get alerted when CVE-2013-6404 or the next vulnerability affects your stack