CVE-2020-24582

2020-09-1017:15:32

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.0%

JSON

Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface.

CPENameOperatorVersion
zulip-desktopeq2.3.4-beta
zulip-desktopeq0.5.7
zulip-desktopeq2.2.0-beta
zulip-desktopeq1.5.0
zulip-desktopeq2.3.7-beta
zulip-desktopeq2.5.0
zulip-desktopeq0.5.1
zulip-desktopeq1.7.0
zulip-desktopeq2.3.82
zulip-desktopeq4.0.2-beta

Name	Operator	Version
zulip-desktop	eq	2.3.4-beta
zulip-desktop	eq	0.5.7
zulip-desktop	eq	2.2.0-beta
zulip-desktop	eq	1.5.0
zulip-desktop	eq	2.3.7-beta
zulip-desktop	eq	2.5.0
zulip-desktop	eq	0.5.1
zulip-desktop	eq	1.7.0
zulip-desktop	eq	2.3.82
zulip-desktop	eq	4.0.2-beta