CVE-2020-9443: XSS
Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This especially affects Zulip Desktop 2.3.82.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zulip Desktopto a version that resolves this vulnerability.Fixed in 4.0.3 - Configuration
Ensure Electron webview loads content with web security enabled (avoid using 'web security disabled'), since Zulip Desktop before 4.0.3 loaded untrusted content with web security disabled.
Zulip Desktop (Electron webview) web security = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2020-9443?
CVE-2020-9443 is classified as a high severity vulnerability due to the potential for XSS attacks.
How do I fix CVE-2020-9443?
To fix CVE-2020-9443, upgrade Zulip Desktop to version 4.0.3 or later.
What versions of Zulip Desktop are affected by CVE-2020-9443?
CVE-2020-9443 affects Zulip Desktop versions prior to 4.0.3, including 2.3.82.
What kind of vulnerability is CVE-2020-9443?
CVE-2020-9443 is an XSS vulnerability resulting from untrusted content being loaded in a webview with web security disabled.
Can CVE-2020-9443 be exploited remotely?
Yes, CVE-2020-9443 can be exploited remotely if a user interacts with malicious content within the Zulip Desktop application.