Vulnerability Description
In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zulip | Zulip Server | >= 1.7.0, < 2.0.7 |
References
- https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/Vendor Advisory
- https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6Patch
- https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/Vendor Advisory
- https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6Patch
FAQ
What is CVE-2019-18933?
CVE-2019-18933 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an o...
How severe is CVE-2019-18933?
CVE-2019-18933 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-18933?
Check the references section above for vendor advisories and patch information. Affected products include: Zulip Zulip Server.