CVE-2019-18933

    Dashboard / Vulnerabilities / CVE-2019-18933

    CVE-2019-18933

    Published: 21 Nov 2019Last Modified: 7 Aug 2026

    Summary:

    Details: In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.

    References: https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/, https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ff6a502200bf6fdc1796a5d919a7a66b6ec5a9c9
    Fixed -1bf0a92eb6a4ae1e30aaab8ff13a3858085764f7

    Affected versions

    2.0.6
    2.0.5
    2.0.4
    2.0.3
    2.0.2
    2.0.1
    2.0.0
    2.0.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2019-18933 | CVE-DB