An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/97159 | Third Party Advisory Vendor Advisory |
https://github.com/zulip/zulip/commit/7ecda1ac8e26d8fb3725e954b2dc4723dda2255f | Patch Third Party Advisory |
https://groups.google.com/d/msg/zulip-announce/VyawgRuoY34/NTBwnTArGwAJ | Patch Release Notes Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: hackerone
Published: 2017-03-28T02:46:00
Updated: 2017-03-29T09:57:01
Reserved: 2016-11-30T00:00:00
Link: CVE-2017-0881
JSON object: View
NVD Information
Status : Modified
Published: 2017-03-28T02:59:01.463
Modified: 2019-10-09T23:21:06.807
Link: CVE-2017-0881
JSON object: View
Redhat Information
No data.