« Back to list

CVE-2016-4426

Status: ModifiedMedium (4.3)—

In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Zulip — Zulip

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2016-4426",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "zulip",
          "versions": [
            {
              "status": "affected",
              "version": "zulip 1.3.12"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-28T17:15:08.050",
  "references": [
    {
      "url": "https://zulip.readthedocs.io/en/2.1.7/overview/changelog.html#id35",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://zulip.readthedocs.io/en/2.1.7/overview/changelog.html#id35",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In zulip before 1.3.12, bot API keys were accessible to other users in the same realm."
    },
    {
      "lang": "es",
      "value": "En zulip versiones anteriores a 1.3.12, las claves de la API de los bots eran accesibles para otros usuarios del mismo reino"
    }
  ],
  "lastModified": "2026-06-17T00:47:32.020",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zulip:zulip:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39F96717-754B-46C6-ACFF-C96DB337A6B1",
              "versionEndExcluding": "1.3.12"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}