Apple Ichat Server vulnerabilities

2 CVEs affecting Apple Ichat Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-4672, published 2012-08-25.

More from Apple.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-1999-0897, published 1998-09-09. Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days. iChat ROOMS Webserver allows remote attackers to read arbitrary files via a .. (dot dot) attack.
• CVE-2012-4672, published 2012-08-25. Medium severity, CVSS 5.8. EPSS: 0.8% chance of exploitation in the next 30 days. Apple iChat Server does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via responses for domains that were not asserted.