CVE-2022-31134: Zulip Server public data export contains attachments that are non-public
Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many configurations server administrators are not expected to have access to private messages and private streams. However, the "public data" export which administrators could generate contained the attachment contents for all attachments, even those from private messages and streams. Zulip Server version 5.4 contains a patch for this issue.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-31134?
CVE-2022-31134 is a vulnerability in Zulip Server versions 2.1.0 and above that allows server owners and administrators to download a "public data" export, potentially exposing sensitive information.
What is the severity of CVE-2022-31134?
The severity of CVE-2022-31134 is medium with a CVSS score of 4.9.
How does CVE-2022-31134 affect Zulip Server?
CVE-2022-31134 affects Zulip Server versions 2.1.0 and above, allowing server owners and administrators to download a "public data" export.
How can CVE-2022-31134 be exploited?
CVE-2022-31134 can be exploited by server owners and administrators who have access to the user interface tool for downloading "public data" exports.
How can I fix CVE-2022-31134 in Zulip Server?
To fix CVE-2022-31134 in Zulip Server, update to version 5.4 or higher, as this vulnerability is patched in Zulip Server 5.4.