CVE-2024-21630

CVSS 3.1 Score 4.3 of 10 (medium)

Details

Published Jan 25, 2024
Updated: Jan 31, 2024
CWE ID 862

Summary

CVE-2024-21630 is a vulnerability that affects version 8.0 of Zulip, an open-source team collaboration tool. This vulnerability is similar to CVE-2023-32677 but specifically applies to multi-use invitations instead of single-use invitation links. It occurs when non-admins are allowed to invite users and create multi-use invitations while only admins can invite users to streams. However, this vulnerability does not allow users to invite new users to arbitrary streams, only to streams that the inviter can already see. The issue is resolved in version 8.1, but as a workaround, administrators can limit sending invitations to users who also have permission to add users to streams. The potential danger of this vulnerability is rated as medium severity with a base score of 4.3 out of 10, indicating a low privilege requirement and no user interaction necessary for exploitation.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-21630 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options