CVE-2017-0910

High

Published: 27/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Zulip Server before 1.7.1, a vulnerability in the invitation system allows an authorized user from one realm on the server to create a user account in any other realm.

Risk Assessment

This vulnerability may lead to unauthorized access to user accounts across different realms, posing a threat to the organization's data security.

Recommendation

It is recommended to upgrade Zulip Server to version 1.7.1 or later to mitigate this vulnerability.

Other vulnerabilities in Zulip Server

CVE-2023-33186High
Zulip, a team collaboration tool, has a cross-site scripting (XSS) vulnerability in tooltips on the message feed. An attacker can craft a malicious topic for a message that, when hovered over by a victim, executes JavaScript code controlled by the attacker.

Original NVD description (English source)

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS