PT-2022-16855 · Zulip · Zulip

Alexmv · Published 2022-03-16 · Updated 2022-03-22 · CVE-2022-24751

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zulip versions 4.0 through 4.10

Description Zulip is an open source group chat application that is vulnerable to a race condition during account deactivation. This issue may allow continued access by a deactivated user in rare cases if there is simultaneous access by the user being deactivated.

Recommendations For Zulip versions 4.0 through 4.10, upgrade to version 4.11 on the 4.x branch or version 5.0-rc1 on the 5.x branch to resolve the issue. Upgrading to a fixed version will deactivate any cached sessions that may have been leaked through this bug.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2022-24751

GHSA-6V98-M5X5-PHQJ

Affected Products

Zulip

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24751.json · Exploit
• https://github.com/zulip/zulip/commit/62ba8e455d8f460001d9fb486a6dabfd1ed67717 · Patch
• https://github.com/zulip/zulip/commit/e6eace307ef435eec3395c99247155efed9219e4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24751 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24751 · Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-6v98-m5x5-phqj · Note
• https://t.me/cibsecurity/39060 · Telegram Post