CVE-2022-41914

Katalog CVE

CVSS 3.7 · Low EPSS 0,56%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada zulip server. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be possible for an attacker to infer the value of the token by performing a sophisticated timing analysis on a large number of failing requests. If successful, this would allow the attacker to impersonate the SCIM client for its abilities to read and update user accounts in the Zulip organization. Organizations where SCIM account management has not been enabled are not affected.

Rincian

Terbit di NVD

16 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-203: Observable Discrepancy

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 44,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zulip/zulip/commit/59edbfa4113d140d3e20126bc65f4d67b2a8ffe5 patch · advisory pihak ketiga
• https://github.com/zulip/zulip/security/advisories/GHSA-q5gx-377v-w76f advisory pihak ketiga