PT-2019-14586 · Zulip · Zulip Server

Published 2019-09-18 · Updated 2019-09-18 · CVE-2019-16216

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zulip server versions prior to 2.0.5

Description The issue allows a logged-in user to upload files of certain types, potentially leading to a stored cross-site scripting attack on other logged-in users. The effectiveness of the attack depends on the browser and the uploads backend used by the Zulip server. For servers using the default local uploads backend, the attack is only effective against browsers lacking support for Content-Security-Policy, such as Internet Explorer 11. For servers using the S3 uploads backend, the attack is confined to the origin of the configured S3 uploads hostname and cannot reach the Zulip server itself.

Recommendations For versions prior to 2.0.5, update to version 2.0.5 or later to resolve the issue. As a temporary workaround, consider restricting file uploads or implementing additional security measures to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16216

Affected Products

Zulip Server

References · 4

• https://github.com/zulip/zulip/commit/1195841dfb9aa26b3b0dabc6f05d72e4af25be3e · Patch
• https://osv.dev/vulnerability/CVE-2019-16216 · Vendor Advisory
• https://blog.zulip.org/2019/09/11/zulip-server-2-0-5-security-release · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16216 · Security Note