In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.
References
Link | Resource |
---|---|
http://blog.zulip.org/2017/11/23/zulip-1-7-1-released/ | Vendor Advisory |
https://github.com/zulip/zulip/commit/960d736e55cbb9386a68e4ee45f80581fd2a4e32 | Patch Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: hackerone
Published: 2017-11-23T00:00:00
Updated: 2017-11-27T15:57:01
Reserved: 2016-11-30T00:00:00
Link: CVE-2017-0910
JSON object: View
NVD Information
Status : Modified
Published: 2017-11-27T16:29:00.217
Modified: 2019-10-09T23:21:11.790
Link: CVE-2017-0910
JSON object: View
Redhat Information
No data.