CVE-2022-35962: Crafted link in Zulip message can cause disclosure of credentials
Published Aug 29, 2022
·Updated
Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sent by an authenticated user could lead to credential disclosure if a user follows the link. A patch was released in version 27.190.
Affected Software
2 affected components
Zulip Zulip Android<27.190
Zulip Zulip Iphone Os<27.190
Event History
Aug 29, 2022
CVE Published
via MITRE·02:50 PM
Data Sourced
via MITRE·02:50 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2022-35962?
CVE-2022-35962 is a vulnerability in Zulip Mobile where a crafted link in a message could lead to credential disclosure.
2
How does CVE-2022-35962 affect Zulip Mobile?
CVE-2022-35962 affects Zulip Mobile versions up to exclusive 27.189.
3
What is the severity of CVE-2022-35962?
CVE-2022-35962 has a severity rating of 5.7 (high).
4
How can I fix CVE-2022-35962?
You can fix CVE-2022-35962 by updating Zulip Mobile to version 27.190 or later.
5
Where can I find more information about CVE-2022-35962?
You can find more information about CVE-2022-35962 on the Zulip blog and Zulip Mobile GitHub page.