CVE-2019-18933
In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.35% probability · 70th percentile
- CISA KEV
- Not listed
- Affected
- zulip/zulip server
- Source
- cve@mitre.org
References
- https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/Vendor Advisory
- https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6Patch
- https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/Vendor Advisory
- https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.