CVE-2017-0896: Medium severity zulip server vulnerability
Published Jun 2, 2017
·Updated
Zulip Server 1.5.1 and below suffer from an error in the implementation of the invitebyadminsonly setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.
Affected Software
19 affected components
Zulip Server=1.3.0
Zulip Server=1.3.1
Zulip Server=1.3.2
Zulip Server=1.3.3
Zulip Server=1.3.4
Zulip Server=1.3.6
Zulip Server=1.3.7
Zulip Server=1.3.8
Zulip Server=1.3.9
Zulip Server=1.3.10
Zulip Server=1.3.11
Zulip Server=1.3.12
Zulip Server=1.3.13
Zulip Server=1.4.0
Zulip Server=1.4.1
Zulip Server=1.4.2
Zulip Server=1.4.3
Zulip Server=1.5.0
Zulip Server=1.5.1
Remediation
Event History
Jun 2, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-0896?
CVE-2017-0896 is classified as a medium severity vulnerability.
2
How do I fix CVE-2017-0896?
To fix CVE-2017-0896, upgrade to Zulip Server version 1.5.2 or later.
3
What impact does CVE-2017-0896 have on Zulip Server?
CVE-2017-0896 allows an authenticated user to invite other users to a Zulip organization despite restrictions.
4
Which versions of Zulip Server are affected by CVE-2017-0896?
Zulip Server version 1.5.1 and earlier versions are affected by CVE-2017-0896.
5
Can CVE-2017-0896 be exploited remotely?
CVE-2017-0896 requires authenticated access, thus it cannot be exploited remotely without user credentials.