CVE-2022-35962: zulip — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2022-35962

CVSS 5.7 · Medium EPSS 1,1%

Kerentanan Incomplete List of Disallowed Inputs pada zulip. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sent by an authenticated user could lead to credential disclosure if a user follows the link. A patch was released in version 27.190.

Rincian

Terbit di NVD: 29 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-184: Incomplete List of Disallowed Inputs
CWE-436: Interpretation Conflict
CWE-697: Incorrect Comparison
EPSS (30 hari): 1,1% peluang dieksploitasi; lebih tinggi dari 65,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
zulip	zulip	Semua versi sebelum 27.190

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://blog.zulip.com/2022/08/24/zulip-server-5-6-security-release/ release notes · advisory vendor
https://github.com/zulip/zulip-mobile/releases/tag/v27.190 advisory pihak ketiga
https://github.com/zulip/zulip-mobile/security/advisories/GHSA-4gj2-j32x-4wg5 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.