CVE-2024-21630: Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to
Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zulipto a version that resolves this vulnerability.Fixed in 8.1 - Configuration
As a workaround, limit sending of invitations to users who also have the permission to add users to streams (avoid allowing non-admins to send multi-use invitations under conditions where only admins can invite to streams).
Zulip multi-use invitation permissions / sending invitations = limit to users who have permission to add users to streams
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21630?
CVE-2024-21630 is classified as a moderate severity vulnerability due to its impact on multi-use invitation management.
How do I fix CVE-2024-21630?
To fix CVE-2024-21630, update to Zulip server version 8.1 or later where the vulnerability has been addressed.
Who is affected by CVE-2024-21630?
CVE-2024-21630 affects installations of Zulip server versions between 1.9.0 and 6.2 and also those within the version 8.0.
What are the implications of CVE-2024-21630?
The implications of CVE-2024-21630 include the potential for unauthorized access through multi-use invitation links configured for non-admin users.
Is CVE-2024-21630 related to previous vulnerabilities?
Yes, CVE-2024-21630 is similar to CVE-2023-32677, but specifically addresses issues with multi-use invitations instead of single-use invitations.