CVE-2022-31134: falha de média gravidade em zulip
Zulip Server public data export contains attachments that are non-public
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.9epss 0.9%
Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many configurations server administrators are not expected to have access to private messages and private streams. However, the "public data" export which administrators could generate contained the attachment contents for all attachments, even those from private messages and streams. Zulip Server version 5.4 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
zulip · zulipCVEs relacionadas — zulip
No mesmo produto, das mais perigosas para as menos.
CVE-2021-43799HIGHRabbitMQ exposes ports with weak default secrets in Zulip ServerEPSS 5.4%CVE-2021-41115MEDIUMRegular expression denial-of-service in ZulipEPSS 1.7%CVE-2022-21706HIGHMulti-use invitations can grant access to other organizations in ZulipEPSS 1.2%CVE-2022-24751MEDIUMRace condition in ZulipEPSS 1.0%CVE-2022-31168MEDIUMZulip Server insufficient authorization for changing bot rolesEPSS 0.8%CVE-2026-115574MEDIUMZulip: Custom profile fields can be read by logged-out visitors in organization with web-public channelsEPSS 0.7%