PT-2020-20664 · Zulip · Zulip Server

Published 2020-04-20 · Updated 2020-04-28 · CVE-2020-9444

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 2.1.3

Description The issue allows reverse tabnabbing via the Markdown functionality.

Recommendations For versions prior to 2.1.3, update to version 2.1.3 or later to resolve the issue.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2020-9444

Affected Products

Zulip Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-9444 · Security Note
• https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9444 · Vendor Advisory