CVE-2021-43791: Ineffective expiration validation for invitation links in Zulip
Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a user to the checkpreregkeyandredirect endpoint, before getting redirected to POST to /accounts/register/. The problem was that validation was happening in the checkpreregkeyandredirect part and not in /accounts/register/ - meaning that one could submit an expired confirmation key and be able to register. The issue is fixed in Zulip 4.8. There are no known workarounds and users are advised to upgrade as soon as possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43791?
The severity of CVE-2021-43791 is medium with a CVSS score of 5.3.
How does CVE-2021-43791 affect Zulip?
CVE-2021-43791 affects Zulip versions up to 4.8.
What is the CWE category of CVE-2021-43791?
The CWE category of CVE-2021-43791 is CWE-613.
How can I fix CVE-2021-43791 in Zulip?
To fix CVE-2021-43791 in Zulip, update to a version higher than 4.8.
Where can I find more information about CVE-2021-43791?
You can find more information about CVE-2021-43791 on the official GitHub page and the security advisories page of Zulip.