PT-2023-30530 · Zulip · Zulip

Alexmv · Publicado 2023-11-16 · Atualizado 2023-11-25 · CVE-2023-47642

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zulip versions prior to 7.5

Description A security issue was found in Zulip, an open-source team collaboration tool, where users who had been removed from a stream could still access its metadata using the Zulip API. This included stream name, description, settings, and an email address used for incoming email integration. As a result, users could see changes to a stream's metadata after they had lost access to the stream.

Recommendations For versions prior to 7.5, upgrade to version 7.5 to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-47642

GHSA-C9WC-65FH-9X8P

Produtos afetados

Zulip

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47642.json · Exploit
• https://github.com/zulip/zulip/commit/6336322d2f9bbccaacfc80cba83a3c62eefd5737 · Correção
• https://github.com/zulip/zulip/security/advisories/GHSA-c9wc-65fh-9x8p · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-47642 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-47642 · Nota de Segurança