FKIE_CVE-2017-0896

Vulnerability from fkie_nvd - Published: 2017-06-02 17:29 - Updated: 2026-06-17 00:58
Severity
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Summary
Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.
References
support@hackerone.comhttps://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761bIssue Tracking, Patch
support@hackerone.comhttps://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ
support@hackerone.comhttps://hackerone.com/reports/224210Permissions Required
af854a3a-2127-422b-91ae-364da2661108https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761bIssue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/224210Permissions Required
Impacted products
Vendor Product Version
zulip zulip_server 1.3.0
zulip zulip_server 1.3.1
zulip zulip_server 1.3.2
zulip zulip_server 1.3.3
zulip zulip_server 1.3.4
zulip zulip_server 1.3.6
zulip zulip_server 1.3.7
zulip zulip_server 1.3.8
zulip zulip_server 1.3.9
zulip zulip_server 1.3.10
zulip zulip_server 1.3.11
zulip zulip_server 1.3.12
zulip zulip_server 1.3.13
zulip zulip_server 1.4.0
zulip zulip_server 1.4.1
zulip zulip_server 1.4.2
zulip zulip_server 1.4.3
zulip zulip_server 1.5.0
zulip zulip_server 1.5.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Zulip Server",
          "vendor": "Zulip",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.1 and below"
            }
          ]
        }
      ],
      "source": "support@hackerone.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "03ECA4CD-B128-45EA-8A19-5F137BD08690",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0609969D-7C68-4428-A2F3-EA532F6C4045",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "6141BC81-A452-44F0-9A61-B82772D406FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3662F33-CC19-46AE-902F-2A685030FDE3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A20311C-FC51-4ED5-BCBC-955543FD1AF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4CC0654-4F8C-4D1B-B06F-035368E7B120",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "13048A35-82DA-45AF-BB3C-AEBD1A80734B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE689D6F-F774-41AF-B97A-23973E22C9C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C300421-CBDE-4DC2-A41E-38AFDD498725",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "08DE09CC-3869-4686-A36D-F42788FC7118",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A6AAE8C-F5E6-4A9C-9AF1-0D03EB9A7E97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "612DA887-F6BC-45F8-B187-AE23CF2F1027",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.3.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "A21AE1B1-5A7E-447A-9301-1AD965F04833",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "034098C9-DCC3-46CC-9534-811F28F4493D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA56546E-7E0A-49EB-967A-7219C907BE50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CF03C39-6873-4044-96B8-760156D7B1BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0167E36-42E4-4DA5-96FB-CFF0EC8FDA38",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3914FE1E-E734-4B4A-8266-25FB5C32800D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zulip:zulip_server:1.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B25BEDD5-B562-4A2E-8284-07A47CB1F6D3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this."
    },
    {
      "lang": "es",
      "value": "Zulip Server versi\u00f3n 1.5.1 y posteriores, sufre de un error en la implementaci\u00f3n de la configuraci\u00f3n de invite_by_admins_only en el servidor de aplicaciones de chat del grupo Zulip que permiti\u00f3 a un usuario autenticado invitar a otros usuarios a unirse a una organizaci\u00f3n Zulip, incluso si la organizaci\u00f3n fue configurada para evitar esto."
    }
  ],
  "id": "CVE-2017-0896",
  "lastModified": "2026-06-17T00:58:28.930",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-06-02T17:29:00.167",
  "references": [
    {
      "source": "support@hackerone.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b"
    },
    {
      "source": "support@hackerone.com",
      "url": "https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://hackerone.com/reports/224210"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://hackerone.com/reports/224210"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.