Zulip 安全漏洞

Zulip is a powerful open source group chat application from the Zulip team. It is used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. A security vulnerability exists in versions prior to Zulip 27.189 that stems from an attacker's carefully...

PT-2022-23061 · Unknown · Zulip Mobile

Name of the Vulnerable Software and Affected Versions: Zulip Mobile versions 27.189 and earlier Description: A crafted link in a message sent by an authenticated user could lead to credential disclosure if a user follows the link. Recommendations: For Zulip Mobile versions 27.189 and earlier,...

CVE-2016-4426

In zulip before 1.3.12, bot API keys were accessible to other users in the same realm...

CVE-2016-4427

In zulip before 1.3.12, deactivated users could access messages if SSO was enabled...

CVE-2016-4427

In zulip before 1.3.12, deactivated users could access messages if SSO was enabled...

CVE-2016-4426

In zulip before 1.3.12, bot API keys were accessible to other users in the same realm...

Design/Logic Flaw

In zulip before 1.3.12, bot API keys were accessible to other users in the same realm...

Design/Logic Flaw

In zulip before 1.3.12, deactivated users could access messages if SSO was enabled...

CVE-2016-4427

In zulip before 1.3.12, deactivated users could access messages if SSO was enabled...

CVE-2016-4427

CVE-2016-4427 affects Zulip before 1.3.12, where deactivated users could access messages if Single Sign-On (SSO) is enabled. The issue is documented across multiple sources (Red Hat, OSV, NVD/CVE record) and is limited to versions prior to 1.3.12; the security impact is that non-active accounts m...

CVE-2016-4426

In zulip before 1.3.12, bot API keys were accessible to other users in the same realm...

CVE-2016-4426

CVE-2016-4426 affects Zulip prior to 1.3.12, where bot API keys were accessible to other users in the same realm. Remediation: upgrade to Zulip 1.3.12 or later. NVD lists CVSS v3.1 base score 4.3 (Medium). No exploitation details are provided in the available documents.

PT-2022-7863 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip versions prior to 1.3.12 Description: The issue allows bot API keys to be accessible to other users within the same realm. Recommendations: For versions prior to 1.3.12, update to version 1.3.12 or later to resolve the issue...

Zulip 安全漏洞

Zulip is a powerful open source group chat application from the Zulip team. It is used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. A security vulnerability exists in versions prior to Zulip 1.3.12, which stems from the fact that other users...

Zulip 访问控制错误漏洞

Zulip is a powerful open source group chat application from the Zulip team. It is used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. An Access Control Error vulnerability exists in versions prior to Zulip 1.3.12, which stems from a user being...

PT-2022-7864 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip versions prior to 1.3.12 Description: The issue allows deactivated users to access messages when Single Sign-On SSO is enabled. Recommendations: For versions prior to 1.3.12, update to version 1.3.12 or later to resolve the issue...

Privilege Escalation

Zulip is vulnerable to Privilege Escalation. An attacker may exploit the vulnerability by sending a maliciously crafted API call that grants administrator privileges to a bot in control...

CVE-2022-31168

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

Authorization

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

CVE-2022-31168

CVE-2022-31168 affects Zulip Server 5.4 and earlier, where an incorrect authorization check could let a member escalate a bot’s privileges to organization administrator via an API call. The vulnerability is addressed in Zulip Server 5.5. Workarounds include restricting the Who can create bots to ...