CVE-2017-0896

    Dashboard / Vulnerabilities / CVE-2017-0896

    CVE-2017-0896

    Published: 2 Jun 2017Last Modified: 7 Aug 2026

    Summary:

    Details: Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.

    References: https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ, https://hackerone.com/reports/224210, https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- b69c6228af03634061cba29f3aa7200c14e7c626
    Fixed -None

    Affected versions

    1.3.0
    1.3.1
    1.3.10
    1.3.11
    1.3.12
    1.3.13
    1.3.2
    1.3.3
    1.3.4
    1.3.6
    1.3.7
    1.3.8
    1.3.9
    1.3.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2017-0896 | CVE-DB