PT-2017-10710 · Zulip · Zulip Server

Vishnu Ks · Published 2017-11-27 · Updated 2019-10-09 · CVE-2017-0910

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 1.7.1

Description A vulnerability in the invitation system of Zulip Server allows an authorized user of one realm to create a user account on any other realm, given that the server has multiple realms.

Recommendations For versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue.

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

CVE-2017-0910

Affected Products

Zulip Server

References · 4

• https://github.com/zulip/zulip/commit/960d736e55cbb9386a68e4ee45f80581fd2a4e32 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-0910 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0910 · Vendor Advisory
• http://blog.zulip.org/2017/11/23/zulip-1-7-1-released · Vendor Advisory