Vulnerability Description
Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option.
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zulipchat | Zulip Desktop | >= 0.5.10, < 5.2.0 |
Related Weaknesses (CWE)
References
- https://blog.zulip.org/2020/05/06/zulip-desktop-5-2-0-security-release/Vendor Advisory
- https://blog.zulip.org/2020/05/06/zulip-desktop-5-2-0-security-release/Vendor Advisory
FAQ
What is CVE-2020-12637?
CVE-2020-12637 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option.
How severe is CVE-2020-12637?
CVE-2020-12637 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-12637?
Check the references section above for vendor advisories and patch information. Affected products include: Zulipchat Zulip Desktop.