CVE-2008-3969
Status: ModifiedMedium (5)—
Severity5Medium · CVSS 2.0
Exploitation probability2.41 %higher than 84% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of an incomplete fix for CVE-2008-3920.
CVSS
- Base score
- 5
- Version
- 2.0
- Vector
- AV:N/AC:L/Au:N/C:N/I:P/A:N
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 2.41 %
- Percentile among all scored CVEs
- 84
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- NVD-CWE-noinfo
References
Show 22 references
- http://secunia.com/advisories/31690
- http://secunia.com/advisories/31991
- http://security.gentoo.org/glsa/glsa-200809-14.xml
- http://www.bitlbee.org/main.php/changelog.html
- http://www.bitlbee.org/main.php/news.r.html
- http://www.openwall.com/lists/oss-security/2008/09/08/1
- http://www.openwall.com/lists/oss-security/2008/09/09/11
- http://www.securityfocus.com/bid/31342
- https://bugzilla.redhat.com/show_bug.cgi?id=461424
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45132
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00587.html
- http://secunia.com/advisories/31690
- http://secunia.com/advisories/31991
- http://security.gentoo.org/glsa/glsa-200809-14.xml
- http://www.bitlbee.org/main.php/changelog.html
- http://www.bitlbee.org/main.php/news.r.html
- http://www.openwall.com/lists/oss-security/2008/09/08/1
- http://www.openwall.com/lists/oss-security/2008/09/09/11
- http://www.securityfocus.com/bid/31342
- https://bugzilla.redhat.com/show_bug.cgi?id=461424
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45132
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00587.html
Raw JSON (NVD)
Show
{
"id": "CVE-2008-3969",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": true,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2008-09-11T01:13:47.743",
"references": [
{
"url": "http://secunia.com/advisories/31690",
"tags": [
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://secunia.com/advisories/31991",
"tags": [
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://security.gentoo.org/glsa/glsa-200809-14.xml",
"tags": [
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://www.bitlbee.org/main.php/changelog.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://www.bitlbee.org/main.php/news.r.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2008/09/08/1",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2008/09/09/11",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://www.securityfocus.com/bid/31342",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=461424",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45132",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secalert@redhat.com"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00587.html",
"tags": [
"Third Party Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://secunia.com/advisories/31690",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/31991",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://security.gentoo.org/glsa/glsa-200809-14.xml",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.bitlbee.org/main.php/changelog.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.bitlbee.org/main.php/news.r.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2008/09/08/1",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2008/09/09/11",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/31342",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=461424",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45132",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00587.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to \"overwrite\" and \"hijack\" existing accounts via unknown vectors related to \"inconsistent handling of the USTATUS_IDENTIFIED state.\" NOTE: this issue exists because of an incomplete fix for CVE-2008-3920."
},
{
"lang": "es",
"value": "Múltiples vulnerabilidades sin especificar en BitlBee versiones anteriores a 1.2.3 permiten a atacantes remotos \"sobrescribir\" y \"secuestrar\" cuentas existentes a través de vectores no especificados.\r\nNOTA: esta cuestión existe debido a una incompleta para fijar CVE-2008-3920."
}
],
"lastModified": "2026-06-16T22:56:55.063",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bitlbee:bitlbee:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22BB0F1F-4F49-44F6-A843-0FF2BD9B7A1E",
"versionEndExcluding": "1.2.3"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "72E4DB7F-07C3-46BB-AAA2-05CD0312C57F"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert@redhat.com"
}