CVE-2024-36625

Summary

CVE-2024-36625 is a newly identified Cross-Site Scripting (XSS) vulnerability affecting Zulip version 8.3. This issue resides in the replace_emoji_with_text function within ui_util.ts. An attacker can exploit this vulnerability by injecting malicious scripts into messages, potentially stealing user session tokens or executing arbitrary code in the victim's browser. Successful exploitation requires the user to view a specially crafted message within the Zulip application. Users are advised to upgrade to the latest version of Zulip as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.