CVE-2017-0881: Infoleak
An error in the implementation of an autosubscribe feature in the checkstreamexists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-0881?
CVE-2017-0881 is considered a medium severity vulnerability due to its impact on the privacy of private streams.
How do I fix CVE-2017-0881?
To fix CVE-2017-0881, upgrade to Zulip Server version 1.4.3 or later.
Who is affected by CVE-2017-0881?
CVE-2017-0881 affects authenticated users of Zulip group chat applications prior to version 1.4.3.
What is the primary vulnerability in CVE-2017-0881?
The primary vulnerability in CVE-2017-0881 is an error in the autosubscribe feature that allows unauthorized access to private streams.
Can CVE-2017-0881 allow users to bypass private stream invitations?
Yes, CVE-2017-0881 allows authenticated users to subscribe to private streams without the required invitation.