Vulnerability Details CVE-2024-21630
Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 30.5%
CVSS Severity
CVSS v3 Score 4.3
References
- https://github.com/zulip/zulip/commit/0df7bd71f32f3b772e2646c6ab0d60c9b610addf
- https://github.com/zulip/zulip/security/advisories/GHSA-87p9-wprh-7rm6
- https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc
- https://zulip.com/help/configure-who-can-invite-to-streams
- https://zulip.com/help/restrict-account-creation#change-who-can-send-invitations
- https://github.com/zulip/zulip/commit/0df7bd71f32f3b772e2646c6ab0d60c9b610addf
- https://github.com/zulip/zulip/security/advisories/GHSA-87p9-wprh-7rm6
- https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc
- https://zulip.com/help/configure-who-can-invite-to-streams
- https://zulip.com/help/restrict-account-creation#change-who-can-send-invitations
Products affected by CVE-2024-21630
-
cpe:2.3:a:zulip:zulip_server:1.9.0
-
cpe:2.3:a:zulip:zulip_server:1.9.1
-
cpe:2.3:a:zulip:zulip_server:1.9.2
-
cpe:2.3:a:zulip:zulip_server:2.0.0
-
cpe:2.3:a:zulip:zulip_server:2.0.1
-
cpe:2.3:a:zulip:zulip_server:2.0.2
-
cpe:2.3:a:zulip:zulip_server:2.0.3
-
cpe:2.3:a:zulip:zulip_server:2.0.4
-
cpe:2.3:a:zulip:zulip_server:2.0.5
-
cpe:2.3:a:zulip:zulip_server:2.0.6
-
cpe:2.3:a:zulip:zulip_server:2.0.7
-
cpe:2.3:a:zulip:zulip_server:2.0.8
-
cpe:2.3:a:zulip:zulip_server:2.1.0
-
cpe:2.3:a:zulip:zulip_server:2.1.1
-
cpe:2.3:a:zulip:zulip_server:2.1.2
-
cpe:2.3:a:zulip:zulip_server:2.1.3
-
cpe:2.3:a:zulip:zulip_server:2.1.4
-
cpe:2.3:a:zulip:zulip_server:2.1.5
-
cpe:2.3:a:zulip:zulip_server:2.1.6
-
cpe:2.3:a:zulip:zulip_server:2.1.7
-
cpe:2.3:a:zulip:zulip_server:3.0
-
cpe:2.3:a:zulip:zulip_server:3.1
-
cpe:2.3:a:zulip:zulip_server:5.0
-
cpe:2.3:a:zulip:zulip_server:5.1
-
cpe:2.3:a:zulip:zulip_server:5.2
-
cpe:2.3:a:zulip:zulip_server:5.3
-
cpe:2.3:a:zulip:zulip_server:5.4
-
cpe:2.3:a:zulip:zulip_server:5.5
-
cpe:2.3:a:zulip:zulip_server:5.6
-
cpe:2.3:a:zulip:zulip_server:5.7
-
cpe:2.3:a:zulip:zulip_server:6.0
-
cpe:2.3:a:zulip:zulip_server:6.1
-
cpe:2.3:a:zulip:zulip_server:8.0