CVE-2024-21630
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
25/01/2024
Last modified:
31/01/2024
Description
Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams.
Impact
Base Score 3.x
4.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:* | 1.9.0 (including) | 6.2 (excluding) |
| cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:* | 8.0 (including) | 8.1 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://github.com/zulip/zulip/commit/0df7bd71f32f3b772e2646c6ab0d60c9b610addf
- https://github.com/zulip/zulip/security/advisories/GHSA-87p9-wprh-7rm6
- https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc
- https://zulip.com/help/configure-who-can-invite-to-streams
- https://zulip.com/help/restrict-account-creation#change-who-can-send-invitations