CVE-2019-19775

2019-12-1804:15:15

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.1%

JSON

The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users.

CPENameOperatorVersion
zulipeq2.0.3
zulipeq2.0.6
zulipeq2.0.5
zulipeq2.0.7
zulipeq2.0.1
zulipeq1.9.0
zulipeq2.0.4
zulipeq2.0.0-rc1
zulipeq2.0.2
zulipeq2.0.0

Name	Operator	Version
zulip	eq	2.0.3
zulip	eq	2.0.6
zulip	eq	2.0.5
zulip	eq	2.0.7
zulip	eq	2.0.1
zulip	eq	1.9.0
zulip	eq	2.0.4
zulip	eq	2.0.0-rc1
zulip	eq	2.0.2
zulip	eq	2.0.0

References

blog.zulip.org/2019/12/13/zulip-server-2-0-8-security-release/

github.com/zulip/zulip/commit/b7c87a4d82397a5e6ac169b6098bed0b1ae7a583