Vulnerabilities > CVE-2019-16215 - Unspecified vulnerability in Zulip Server

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

zulip

NVD

Published: 2019-09-18

Updated: 2024-11-21

Summary

The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages.

Vulnerable Configurations

Part	Description	Count
Application	Zulip Zulip Zulip Server 1.1.5 Zulip Zulip Server 1.2.0 Zulip Zulip Server 1.2.1 Zulip Zulip Server 1.3.0 Zulip Zulip Server 1.3.1 Zulip Zulip Server 1.3.2 Zulip Zulip Server 1.3.3 Zulip Zulip Server 1.3.4 Zulip Zulip Server 1.3.5 Zulip Zulip Server 1.3.6 Zulip Zulip Server 1.3.7 Zulip Zulip Server 1.3.8 Zulip Zulip Server 1.3.9 Zulip Zulip Server 1.3.10 Zulip Zulip Server 1.3.11 Zulip Zulip Server 1.3.12 Zulip Zulip Server 1.3.13 Zulip Zulip Server 1.4.0 Zulip Zulip Server 1.4.1 Zulip Zulip Server 1.4.2 Zulip Zulip Server 1.4.3 Zulip Zulip Server 1.5.0 Zulip Zulip Server 1.5.1 Zulip Zulip Server 1.5.2 Zulip Zulip Server 1.6.0 Zulip Zulip Server 1.7.0 Zulip Zulip Server 1.7.1 Zulip Zulip Server 1.7.2 Zulip Zulip Server 1.8.0 Zulip Zulip Server 1.8.1 Zulip Zulip Server 1.9.0 Zulip Zulip Server 1.9.1 Zulip Zulip Server 1.9.2 Zulip Zulip Server 2.0.0 Zulip Zulip Server 2.0.1 Zulip Zulip Server 2.0.2 Zulip Zulip Server 2.0.3 Zulip Zulip Server 2.0.4	44

Summary

Vulnerable Configurations

References