Lucene search

HackeroneCVE-2017-0881

HistoryMar 28, 2017 - 2:59 a.m.

CVE-2017-0881

2017-03-2802:59:01

CWE-200

CWE-863

hackerone

web.nvd.nist.gov

cve-2017-0881

zulip

group chat

application server

security vulnerability

autosubscribe

private stream

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server.

Affected configurations

Nvd

Vulners

Node

zulipzulip_serverRange<1.4.3

VendorProductVersionCPE
zulipzulip_server*cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zulip	zulip_server	*	cpe:2.3:a:zulip:zulip_server::::::::

CNA Affected

[
  {
    "product": "Zulip Server Versions 1.4.2 and below",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Zulip Server Versions 1.4.2 and below"
      }
    ]
  }
]

References

www.securityfocus.com/bid/97159

github.com/zulip/zulip/commit/7ecda1ac8e26d8fb3725e954b2dc4723dda2255f

groups.google.com/d/msg/zulip-announce/VyawgRuoY34/NTBwnTArGwAJ

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

Related for CVE-2017-0881