CVE-2017-0881

🗓️ 28 Mar 2017 02:46:00Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 46 Views

An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server

Reporter	Title	Published	Views	Family All 5
CNVD	Zulip Server Security Bypass Vulnerability	31 Mar 201700:00	–	cnvd
Cvelist	CVE-2017-0881	28 Mar 201702:46	–	cvelist
EUVD	EUVD-2017-1235	7 Oct 202500:30	–	euvd
NVD	CVE-2017-0881	28 Mar 201702:59	–	nvd
Prion	Design/Logic Flaw	28 Mar 201702:59	–	prion

NVD

Vulners

Node

zulip zulip_serverRange<1.4.3

[
  {
    "product": "Zulip Server Versions 1.4.2 and below",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Zulip Server Versions 1.4.2 and below"
      }
    ]
  }
]

Source	Link
groups	www.groups.google.com/d/msg/zulip-announce/VyawgRuoY34/NTBwnTArGwAJ
securityfocus	www.securityfocus.com/bid/97159
github	www.github.com/zulip/zulip/commit/7ecda1ac8e26d8fb3725e954b2dc4723dda2255f