Zulip Server has access control bypass for restrictions on creation of specific channel types
概要
Zulip Server has access control bypass for restrictions on creation of specific channel types
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanism can be circumvented by creating a private or web-public channel, and then changing the channel privacy to public. A similar technique works for creating private channels without permission, though such a process requires either the API or modifying the HTML, as we do mark the "private" radio button as disabled in such cases. Version 10.3 contains a patch.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web zulip.com
- web zulip.readthedocs.io