CVE-2020-24582: XSS
Published Sep 10, 2020
·Updated
Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface.
Affected Software
1 affected component
Zulipchat Zulip Desktop<5.4.3
Event History
Sep 10, 2020
CVE Published
via MITRE·04:11 PM
Data Sourced
via MITRE·04:11 PM
Description
Frequently Asked Questions
1
What is CVE-2020-24582?
CVE-2020-24582 is a vulnerability in Zulip Desktop before 5.4.3 that allows XSS (Cross-Site Scripting) attacks due to mishandling of string escaping in the HTML composition of the user interface.
2
What is the severity of CVE-2020-24582?
The severity of CVE-2020-24582 is medium (6.1).
3
How does CVE-2020-24582 affect Zulip Desktop?
CVE-2020-24582 affects Zulip Desktop versions up to but excluding 5.4.3.
4
How can CVE-2020-24582 be exploited?
CVE-2020-24582 can be exploited through XSS attacks by injecting malicious scripts into the user interface of Zulip Desktop.
5
Is there a fix for CVE-2020-24582?
Yes, the fix for CVE-2020-24582 is available in Zulip Desktop version 5.4.3 or later.