CVE-2017-0910

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.

Score

CVSS 3.0 8.8 High

Status

Modified - support@hackerone.com

Published

2017-11-27

Last modified

2024-09-17

Weaknesses

CWE-287, CWE-863

Affected products

• Zulip Server (Zulip)

References

• http://blog.zulip.org/2017/11/23/zulip-1-7-1-released/
• https://github.com/zulip/zulip/commit/960d736e55cbb9386a68e4ee45f80581fd2a4e32