Vulnerabilities > CVE-2022-31168 - Incorrect Authorization vulnerability in Zulip

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

zulip

CWE-863

NVD

Published: 2022-07-22

Updated: 2023-11-07

Summary

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and lack permission to create them, can’t exploit the vulnerability. As a workaround for the vulnerability, an organization administrator can restrict the `Who can create bots` permission to administrators only, and change the ownership of existing bots.

Vulnerable Configurations

Part	Description	Count
Application	Zulip Zulip Zulip - Zulip Zulip 0.7.1 Zulip Zulip 1.0.11 Zulip Zulip 1.0.12 Zulip Zulip 1.0.13 Zulip Zulip 1.0.14 Zulip Zulip 1.0.15 Zulip Zulip 1.0.16 Zulip Zulip 1.0.17 Zulip Zulip 1.0.18 Zulip Zulip 1.0.19 Zulip Zulip 1.0.20 Zulip Zulip 1.0.21 Zulip Zulip 1.0.22 Zulip Zulip 1.0.24 Zulip Zulip 1.0.25 Zulip Zulip 1.0.26 Zulip Zulip 1.0.27 Zulip Zulip 1.0.29 Zulip Zulip 1.3.0 Zulip Zulip 1.3.1 Zulip Zulip 1.3.2 Zulip Zulip 1.3.3 Zulip Zulip 1.3.4 Zulip Zulip 1.3.5 Zulip Zulip 1.3.6 Zulip Zulip 1.3.7 Zulip Zulip 1.3.8 Zulip Zulip 1.3.9 Zulip Zulip 1.3.10 Zulip Zulip 1.3.11 Zulip Zulip 1.3.12 Zulip Zulip 1.3.13 Zulip Zulip 1.4.0 Zulip Zulip 1.4.1 Zulip Zulip 1.4.2 Zulip Zulip 1.4.3 Zulip Zulip 1.5.0 Zulip Zulip 1.5.1 Zulip Zulip 1.5.2 Zulip Zulip 1.6.0 Zulip Zulip 1.7.0 Zulip Zulip 1.7.1 Zulip Zulip 1.7.2 Zulip Zulip 1.8.0 Zulip Zulip 1.8.1 Zulip Zulip 1.9.0 Zulip Zulip 1.9.1 Zulip Zulip 1.9.2 Zulip Zulip 2.0.0 Zulip Zulip 2.0.1 Zulip Zulip 2.0.2 Zulip Zulip 2.0.3 Zulip Zulip 2.0.4 Zulip Zulip 2.0.5 Zulip Zulip 2.0.6 Zulip Zulip 2.0.7 Zulip Zulip 2.0.8 Zulip Zulip 2.1.0 Zulip Zulip 2.1.1 Zulip Zulip 2.1.2 Zulip Zulip 2.1.3 Zulip Zulip 2.1.4 Zulip Zulip 2.1.5 Zulip Zulip 2.1.6 Zulip Zulip 2.1.7 Zulip Zulip 2.1.8 Zulip Zulip 2.1.33 Zulip Zulip 2.2 Zulip Zulip 2.3.35 Zulip Zulip 2.7.39 Zulip Zulip 3.0 Zulip Zulip 3.0.40 Zulip Zulip 3.1 Zulip Zulip 3.1.41 Zulip Zulip 3.2 Zulip Zulip 3.2.42 Zulip Zulip 3.3 Zulip Zulip 3.3.43 Zulip Zulip 3.4 Zulip Zulip 4.0 Zulip Zulip 4.1 Zulip Zulip 4.2 Zulip Zulip 4.3 Zulip Zulip 4.4 Zulip Zulip 4.5 Zulip Zulip 4.6 Zulip Zulip 4.7 Zulip Zulip 4.8 Zulip Zulip 4.9 Zulip Zulip 4.10 Zulip Zulip 4.11 Zulip Zulip 5.0 Zulip Zulip 5.0.46 Zulip Zulip 5.1 Zulip Zulip 5.2 Zulip Zulip 5.3 Zulip Zulip 5.4	140

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References