Vulnerabilities > CVE-2024-21630 - Unspecified vulnerability in Zulip Server

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

zulip

NVD

Published: 2024-01-25

Updated: 2024-11-21

Summary

Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams.

Vulnerable Configurations

Part	Description	Count
Application	Zulip Zulip Zulip Server 8.0 Zulip Zulip Server 1.9.0 Zulip Zulip Server 1.9.1 Zulip Zulip Server 1.9.2 Zulip Zulip Server 2.0.0 Zulip Zulip Server 2.0.1 Zulip Zulip Server 2.0.2 Zulip Zulip Server 2.0.3 Zulip Zulip Server 2.0.4 Zulip Zulip Server 2.0.5 Zulip Zulip Server 2.0.6 Zulip Zulip Server 2.0.7 Zulip Zulip Server 2.0.8 Zulip Zulip Server 2.1.0 Zulip Zulip Server 2.1.1 Zulip Zulip Server 2.1.2 Zulip Zulip Server 2.1.3 Zulip Zulip Server 2.1.4 Zulip Zulip Server 2.1.5 Zulip Zulip Server 2.1.6 Zulip Zulip Server 2.1.7 Zulip Zulip Server 3.0 Zulip Zulip Server 3.1 Zulip Zulip Server 5.0 Zulip Zulip Server 5.1 Zulip Zulip Server 5.2 Zulip Zulip Server 5.3 Zulip Zulip Server 5.4 Zulip Zulip Server 5.5 Zulip Zulip Server 5.6 Zulip Zulip Server 5.7 Zulip Zulip Server 6.0 Zulip Zulip Server 6.1	46

Summary

Vulnerable Configurations

References