CVE-2020-15070: Code Injection
Published Aug 21, 2020
·Updated
Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value.
Affected Software
1 affected component
Zulip Server<2.1.7
Event History
Aug 21, 2020
CVE Published
via MITRE·04:28 AM
Data Sourced
via MITRE·04:28 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2020-15070.
2
What is the severity of CVE-2020-15070?
The severity of CVE-2020-15070 is high with a severity value of 8.8.
3
What software versions are affected by CVE-2020-15070?
Zulip Server 2.x versions up to but excluding 2.1.7 are affected by CVE-2020-15070.
4
What is the impact of CVE-2020-15070?
CVE-2020-15070 allows eval injection if a privileged attacker is able to write directly to the PostgreSQL database and craft a custom profile field value.
5
How can I fix CVE-2020-15070?
To fix CVE-2020-15070, update to Zulip Server version 2.1.7 or later.