A vulnerability, which was classified as problematic, has been found in Zulip Server up to 2.0.6. This issue affects an unknown code block of the component Password Authentication. The manipulation with an unknown input leads to a improper authentication vulnerability (API Key). Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality. The summary by CVE is:

In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.

The weakness was released 11/21/2019 (Website). The advisory is shared at blog.zulip.org. The identification of this vulnerability is CVE-2019-18933 since 11/13/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

Upgrading to version 2.0.7 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-21540, VDB-21653, VDB-28076 and VDB-44056.

Productinfo

Vendor

• Zulip

Name

• Server

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion