CVE-2017-0896 - Vulnerability Details

Vendors	Products
Zulip	Zulip Server

Link	Providers
https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b
https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ
https://hackerone.com/reports/224210

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Zulip Server", "vendor": "Zulip", "versions": [{"status": "affected", "version": "1.5.1 and below"}]}], "datePublic": "2017-06-01T00:00:00", "descriptions": [{"lang": "en", "value": "Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "description": "Improper Authorization (CWE-285)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2017-06-02T16:57:01", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"name": "[zulip-announce] 20170601 Zulip Server 1.5.2 released", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ"}, {"tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/224210"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "support@hackerone.com", "ID": "CVE-2017-0896", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Zulip Server", "version": {"version_data": [{"version_value": "1.5.1 and below"}]}}]}, "vendor_name": "Zulip"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper Authorization (CWE-285)"}]}]}, "references": {"reference_data": [{"name": "[zulip-announce] 20170601 Zulip Server 1.5.2 released", "refsource": "MLIST", "url": "https://groups.google.com/forum/#!msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ"}, {"name": "https://hackerone.com/reports/224210", "refsource": "MISC", "url": "https://hackerone.com/reports/224210"}, {"name": "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b", "refsource": "MISC", "url": "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T13:25:16.624Z"}, "title": "CVE Program Container", "references": [{"name": "[zulip-announce] 20170601 Zulip Server 1.5.2 released", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hackerone.com/reports/224210"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b"}]}]}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2017-0896", "datePublished": "2017-06-02T17:00:00", "dateReserved": "2016-11-30T00:00:00", "dateUpdated": "2024-08-05T13:25:16.624Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Zulip Server (string)

vendor : Zulip (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.5.1 and below (string)

}

]

}

]

datePublic : 2017-06-01T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-285 (string)

description : Improper Authorization (CWE-285) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2017-06-02T16:57:01 (string)

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

}

references : [ »

0 : { »

name : [zulip-announce] 20170601 Zulip Server 1.5.2 released (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://hackerone.com/reports/224210 (string)

}

2 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : support@hackerone.com (string)

ID : CVE-2017-0896 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Zulip Server (string)

version : { »

version_data : [ »

0 : { »

version_value : 1.5.1 and below (string)

}

]

}

]

}

vendor_name : Zulip (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Improper Authorization (CWE-285) (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : [zulip-announce] 20170601 Zulip Server 1.5.2 released (string)

refsource : MLIST (string)

url : https://groups.google.com/forum/#!msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ (string)

}

1 : { »

name : https://hackerone.com/reports/224210 (string)

refsource : MISC (string)

url : https://hackerone.com/reports/224210 (string)

}

2 : { »

name : https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b (string)

refsource : MISC (string)

url : https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T13:25:16.624Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : [zulip-announce] 20170601 Zulip Server 1.5.2 released (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://hackerone.com/reports/224210 (string)

}

2 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

assignerShortName : hackerone (string)

cveId : CVE-2017-0896 (string)

datePublished : 2017-06-02T17:00:00 (string)

dateReserved : 2016-11-30T00:00:00 (string)

dateUpdated : 2024-08-05T13:25:16.624Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "03ECA4CD-B128-45EA-8A19-5F137BD08690", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "0609969D-7C68-4428-A2F3-EA532F6C4045", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "6141BC81-A452-44F0-9A61-B82772D406FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "F3662F33-CC19-46AE-902F-2A685030FDE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "7A20311C-FC51-4ED5-BCBC-955543FD1AF5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "B4CC0654-4F8C-4D1B-B06F-035368E7B120", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "13048A35-82DA-45AF-BB3C-AEBD1A80734B", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "BE689D6F-F774-41AF-B97A-23973E22C9C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.9:*:*:*:*:*:*:*", "matchCriteriaId": "7C300421-CBDE-4DC2-A41E-38AFDD498725", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.10:*:*:*:*:*:*:*", "matchCriteriaId": "08DE09CC-3869-4686-A36D-F42788FC7118", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.11:*:*:*:*:*:*:*", "matchCriteriaId": "8A6AAE8C-F5E6-4A9C-9AF1-0D03EB9A7E97", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.12:*:*:*:*:*:*:*", "matchCriteriaId": "612DA887-F6BC-45F8-B187-AE23CF2F1027", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.3.13:*:*:*:*:*:*:*", "matchCriteriaId": "A21AE1B1-5A7E-447A-9301-1AD965F04833", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "034098C9-DCC3-46CC-9534-811F28F4493D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "EA56546E-7E0A-49EB-967A-7219C907BE50", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "2CF03C39-6873-4044-96B8-760156D7B1BE", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "A0167E36-42E4-4DA5-96FB-CFF0EC8FDA38", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "3914FE1E-E734-4B4A-8266-25FB5C32800D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zulip:zulip_server:1.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "B25BEDD5-B562-4A2E-8284-07A47CB1F6D3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this."}, {"lang": "es", "value": "Zulip Server versi\u00f3n 1.5.1 y posteriores, sufre de un error en la implementaci\u00f3n de la configuraci\u00f3n de invite_by_admins_only en el servidor de aplicaciones de chat del grupo Zulip que permiti\u00f3 a un usuario autenticado invitar a otros usuarios a unirse a una organizaci\u00f3n Zulip, incluso si la organizaci\u00f3n fue configurada para evitar esto."}], "id": "CVE-2017-0896", "lastModified": "2024-11-21T03:03:50.790", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-06-02T17:29:00.167", "references": [{"source": "support@hackerone.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b"}, {"source": "support@hackerone.com", "url": "https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ"}, {"source": "support@hackerone.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/224210"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/224210"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "support@hackerone.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 03ECA4CD-B128-45EA-8A19-5F137BD08690 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 0609969D-7C68-4428-A2F3-EA532F6C4045 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 6141BC81-A452-44F0-9A61-B82772D406FF (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.3:*:*:*:*:*:*:* (string)

matchCriteriaId : F3662F33-CC19-46AE-902F-2A685030FDE3 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 7A20311C-FC51-4ED5-BCBC-955543FD1AF5 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.6:*:*:*:*:*:*:* (string)

matchCriteriaId : B4CC0654-4F8C-4D1B-B06F-035368E7B120 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.7:*:*:*:*:*:*:* (string)

matchCriteriaId : 13048A35-82DA-45AF-BB3C-AEBD1A80734B (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.8:*:*:*:*:*:*:* (string)

matchCriteriaId : BE689D6F-F774-41AF-B97A-23973E22C9C9 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.9:*:*:*:*:*:*:* (string)

matchCriteriaId : 7C300421-CBDE-4DC2-A41E-38AFDD498725 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.10:*:*:*:*:*:*:* (string)

matchCriteriaId : 08DE09CC-3869-4686-A36D-F42788FC7118 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.11:*:*:*:*:*:*:* (string)

matchCriteriaId : 8A6AAE8C-F5E6-4A9C-9AF1-0D03EB9A7E97 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.12:*:*:*:*:*:*:* (string)

matchCriteriaId : 612DA887-F6BC-45F8-B187-AE23CF2F1027 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.3.13:*:*:*:*:*:*:* (string)

matchCriteriaId : A21AE1B1-5A7E-447A-9301-1AD965F04833 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.4.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 034098C9-DCC3-46CC-9534-811F28F4493D (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.4.1:*:*:*:*:*:*:* (string)

matchCriteriaId : EA56546E-7E0A-49EB-967A-7219C907BE50 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.4.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 2CF03C39-6873-4044-96B8-760156D7B1BE (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.4.3:*:*:*:*:*:*:* (string)

matchCriteriaId : A0167E36-42E4-4DA5-96FB-CFF0EC8FDA38 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.5.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 3914FE1E-E734-4B4A-8266-25FB5C32800D (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:zulip:zulip_server:1.5.1:*:*:*:*:*:*:* (string)

matchCriteriaId : B25BEDD5-B562-4A2E-8284-07A47CB1F6D3 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this. (string)

}

1 : { »

lang : es (string)

value : Zulip Server versión 1.5.1 y posteriores, sufre de un error en la implementación de la configuración de invite_by_admins_only en el servidor de aplicaciones de chat del grupo Zulip que permitió a un usuario autenticado invitar a otros usuarios a unirse a una organización Zulip, incluso si la organización fue configurada para evitar esto. (string)

}

]

id : CVE-2017-0896 (string)

lastModified : 2024-11-21T03:03:50.790 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 4 (number)

confidentialityImpact : NONE (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:L/Au:S/C:N/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2017-06-02T17:29:00.167 (string)

references : [ »

0 : { »

source : support@hackerone.com (string)

tags : [ »

0 : Issue Tracking (string)

1 : Patch (string)

]

url : https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b (string)

}

1 : { »

source : support@hackerone.com (string)

url : https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ (string)

}

2 : { »

source : support@hackerone.com (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://hackerone.com/reports/224210 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Patch (string)

]

url : https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://hackerone.com/reports/224210 (string)

}

]

sourceIdentifier : support@hackerone.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-285 (string)

}

]

source : support@hackerone.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-862 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object