PT-2024-18982 · Zulip · Zulip

Alexmv · Published 2024-01-25 · Updated 2024-02-01 · CVE-2024-21630

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zulip version 8.0

Description A vulnerability in Zulip affects installations where non-admins can invite users and create multi-use invitations, but only admins can invite users to streams. This issue allows users to invite new users to streams they can already see, but not to arbitrary streams. The estimated number of potentially affected devices is not specified.

Recommendations For version 8.0, as a temporary workaround, administrators can limit the sending of invitations to users who also have the permission to add users to streams. For version 8.0, update to version 8.1 to resolve the issue.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-21630

GHSA-87P9-WPRH-7RM6

GHSA-MRVP-96Q6-JPVC

Affected Products

Zulip

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21630.json · Exploit
• https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc · Vendor Advisory
• https://github.com/zulip/zulip/commit/0df7bd71f32f3b772e2646c6ab0d60c9b610addf · Patch
• https://github.com/zulip/zulip/security/advisories/GHSA-87p9-wprh-7rm6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21630 · Security Note
• https://twitter.com/VulmonFeeds/status/1750640453664244009 · Twitter Post
• https://zulip.com/help/restrict-account-creation#change-who-can-send-invitations · Note
• https://t.me/cvenotify/69440 · Telegram Post
• https://twitter.com/CVEnew/status/1750607596099133455 · Twitter Post
• https://zulip.com/help/configure-who-can-invite-to-streams · Note