Vulnerability record · CVE-2021-37601 · published 30 July 2021

CVE-2021-37601: Prosody vulnerability

Prosody · Prosody

muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.

7.5 CVSS 3.1 High EPSS 2.3% · top 17.2%

7.5CVSS 3.1 base score, v2 5.0

2.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

10References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Prosody Prosody

References

Link	Tags
http://www.openwall.com/lists/oss-security/2021/07/28/4	Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7BZRRPCNOETB4MN4XSYPRBB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMKIOEP2CYWHVVUCNWISPE4
https://prosody.im/	ExploitProduct
https://prosody.im/security/advisory_20210722/	Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/07/28/4	Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7BZRRPCNOETB4MN4XSYPRBB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMKIOEP2CYWHVVUCNWISPE4
https://prosody.im/	ExploitProduct
https://prosody.im/security/advisory_20210722/	Vendor Advisory

Track CVE-2021-37601 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2018-10847Prosody improper authentication vulnerabilityprosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user…EPSS 1.7%30 Jul 2018 7.8CVE-2014-2744Lightwitch metronome improper input validation vulnerabilityplugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is una…EPSS 3.3%11 Apr 2014 7.8CVE-2014-2745Prosody permissions and access controls vulnerabilityProsody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service…EPSS 3.1%11 Apr 2014 7.5CVE-2026-43506Prosody memory leak vulnerabilityAn issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused b…EPSS 0.49%1 May 2026 7.5CVE-2026-43507Prosody allocation without limits vulnerabilityAn issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur via memory exhaustion caused b…EPSS 0.64%1 May 2026 7.5CVE-2022-0217Prosody xml external entity (xxe) vulnerabilityIt was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML da…EPSS 5.4%26 Aug 2022 7.5CVE-2021-32918Prosody uncontrolled resource consumption vulnerabilityAn issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memo…EPSS 2.1%13 May 2021 7.5CVE-2021-32919Prosody improper certificate validation vulnerabilityAn issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature f…EPSS 1.4%13 May 2021

Source: NIST National Vulnerability Database (record CVE-2021-37601), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.