« Volver al listado

CVE-2024-21630

Estado: ModificadaMedia (4.3)—

Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zulip — Zulip Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-21630",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-21630",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-08T15:52:52.338039Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "zulip",
          "product": "zulip",
          "versions": [
            {
              "status": "affected",
              "version": "= 8.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-01-25T20:15:40.423",
  "references": [
    {
      "url": "https://github.com/zulip/zulip/commit/0df7bd71f32f3b772e2646c6ab0d60c9b610addf",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zulip/zulip/security/advisories/GHSA-87p9-wprh-7rm6",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://zulip.com/help/configure-who-can-invite-to-streams",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://zulip.com/help/restrict-account-creation#change-who-can-send-invitations",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zulip/zulip/commit/0df7bd71f32f3b772e2646c6ab0d60c9b610addf",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/zulip/zulip/security/advisories/GHSA-87p9-wprh-7rm6",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://zulip.com/help/configure-who-can-invite-to-streams",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://zulip.com/help/restrict-account-creation#change-who-can-send-invitations",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams."
    },
    {
      "lang": "es",
      "value": "Zulip es una herramienta de colaboración en equipo de código abierto. Una vulnerabilidad en la versión 8.0 es similar a CVE-2023-32677, pero se aplica a invitaciones de usos múltiples, no a enlaces de invitación de un solo uso como en el CVE anterior. Específicamente, se aplica cuando la instalación ha configurado no administradores para poder invitar a usuarios y crear invitaciones de usos múltiples, y también ha configurado solo administradores para poder invitar a usuarios a transmisiones. Al igual que en CVE-2023-32677, esto no permite a los usuarios invitar a nuevos usuarios a transmisiones arbitrarias, solo a transmisiones que quien invita ya puede ver. La versión 8.1 soluciona este problema. Como workaround, los administradores pueden limitar el envío de invitaciones a los usuarios que también tienen permiso para agregar usuarios a las transmisiones."
    }
  ],
  "lastModified": "2026-06-17T07:09:52.967",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D9282FA-F4D4-4667-ADC6-6A3C7C83BB52",
              "versionEndExcluding": "6.2",
              "versionStartIncluding": "1.9.0"
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85FB7719-4DA4-4E4A-B229-6827E35EEF32",
              "versionEndExcluding": "8.1",
              "versionStartIncluding": "8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}