CVE - CVE-2023-32677

CVE-ID
CVE-2023-32677	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite a new user also allows them to set the streams that the new user is invited to -- even if the inviting user would not have permissions to add an existing user to streams. While such a configuration is likely rare in practice, the behavior does violate security-related controls. This does not let a user invite new users to streams they cannot see, or would not be able to add users to if they had that general permission. This issue has been addressed in version 6.2. Users are advised to upgrade. Users unable to upgrade may limit sending of invitations down to users who also have the permission to add users to streams.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/zulip/zulip/commit/7c2693a2c64904d1d0af8503b57763943648cbe5 URL:https://github.com/zulip/zulip/commit/7c2693a2c64904d1d0af8503b57763943648cbe5 MISC:https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc URL:https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc MISC:https://zulip.com/help/configure-who-can-invite-to-streams URL:https://zulip.com/help/configure-who-can-invite-to-streams MISC:https://zulip.com/help/restrict-account-creation#change-who-can-send-invitations URL:https://zulip.com/help/restrict-account-creation#change-who-can-send-invitations
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20230511	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230511)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)