PT-2022-20461 · Zulip+1 · Zulip+1

Alexmv · Published 2022-06-25 · Updated 2022-07-07 · CVE-2022-31017

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zulip versions 2.1.0 through 5.2

Description The issue is related to a logic error in Zulip, an open-source team collaboration tool. When a stream configured as private with protected history is edited, the server incorrectly sends an API event that includes the edited message to all of the stream’s current subscribers. This API event is ignored by official clients but can be observed using a modified client or the browser’s developer tools.

Recommendations For versions 2.1.0 through 5.2, update to Zulip Server 5.3 to resolve the issue. As a temporary workaround, consider restricting access to edited streams to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-571

CWE-670

Related Identifiers

CVE-2022-31017

GHSA-M5J3-JP59-6F3Q

Affected Products

Zulip

Zulip Server

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31017.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-31017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31017 · Security Note
• https://github.com/zulip/zulip/security/advisories/GHSA-m5j3-jp59-6f3q · Note
• https://t.me/cvenotify/32184 · Telegram Post