« Volver al listado

CVE-2017-0896

Estado: ModificadaMedia (6.5)—

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zulip — Zulip Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-0896",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "Zulip",
          "product": "Zulip Server",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.1 and below"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-06-02T17:29:00.167",
  "references": [
    {
      "url": "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://hackerone.com/reports/224210",
      "tags": [
        "Permissions Required"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://hackerone.com/reports/224210",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this."
    },
    {
      "lang": "es",
      "value": "Zulip Server versión 1.5.1 y posteriores, sufre de un error en la implementación de la configuración de invite_by_admins_only en el servidor de aplicaciones de chat del grupo Zulip que permitió a un usuario autenticado invitar a otros usuarios a unirse a una organización Zulip, incluso si la organización fue configurada para evitar esto."
    }
  ],
  "lastModified": "2026-06-17T00:58:28.930",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03ECA4CD-B128-45EA-8A19-5F137BD08690"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0609969D-7C68-4428-A2F3-EA532F6C4045"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6141BC81-A452-44F0-9A61-B82772D406FF"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3662F33-CC19-46AE-902F-2A685030FDE3"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A20311C-FC51-4ED5-BCBC-955543FD1AF5"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4CC0654-4F8C-4D1B-B06F-035368E7B120"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13048A35-82DA-45AF-BB3C-AEBD1A80734B"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE689D6F-F774-41AF-B97A-23973E22C9C9"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C300421-CBDE-4DC2-A41E-38AFDD498725"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08DE09CC-3869-4686-A36D-F42788FC7118"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A6AAE8C-F5E6-4A9C-9AF1-0D03EB9A7E97"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "612DA887-F6BC-45F8-B187-AE23CF2F1027"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A21AE1B1-5A7E-447A-9301-1AD965F04833"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "034098C9-DCC3-46CC-9534-811F28F4493D"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA56546E-7E0A-49EB-967A-7219C907BE50"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CF03C39-6873-4044-96B8-760156D7B1BE"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0167E36-42E4-4DA5-96FB-CFF0EC8FDA38"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3914FE1E-E734-4B4A-8266-25FB5C32800D"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B25BEDD5-B562-4A2E-8284-07A47CB1F6D3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}