SB2022072827 - Information disclosure in Zulip Server
Published: July 28, 2022
Security Bulletin ID
SB2022072827
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-31134)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to improper privilege management in the export public data feature. As a result, all privately uploaded files were made accessible during export, including files from private messages.
Remediation
Install update from vendor's website.