PT-2023-21856 · Zulip · Zulip

Alexmv · Publicado 2023-05-19 · Atualizado 2023-05-26 · CVE-2023-28623

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zulip versions prior to 6.2

Description Zulip is an open-source team collaboration tool with unique topic-based threading. An attacker can create a new account in the organization with an arbitrary email address in their control that's not in the organization's LDAP directory, given that ZulipLDAPAuthBackend and an external authentication backend are the only ones enabled in AUTHENTICATION BACKENDS in /etc/zulip/settings.py and the organization permissions don't require invitations to join. The impact is limited to installations with this specific combination of authentication backends and having Invitations are required for joining this organization organization permission disabled.

Recommendations For versions prior to 6.2, upgrade to version 6.2 to address the issue. As a temporary workaround for users unable to upgrade, enable the Invitations are required for joining this organization organization permission to prevent this issue.

Exploit

Correção

Improper Authorization

Missing Authorization

Enumeração de Fraquezas

CWE-285

CWE-862

Identificadores relacionados

CVE-2023-28623

GHSA-7P62-PJWG-56RV

Produtos afetados

Zulip

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28623.json · Exploit
• https://github.com/zulip/zulip/security/advisories/GHSA-7p62-pjwg-56rv · Nota
• https://github.com/zulip/zulip/commit/3df1b4dd7c210c21deb6f829df19412b74573f8d · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-28623 · Nota de Segurança
• https://t.me/cvenotify/50822 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28623 · Aviso do Fabricante
• https://t.me/cvenotify/51203 · Publicação no Telegram
• https://t.me/cibsecurity/64475 · Publicação no Telegram