Zulip Server has access control bypass for restrictions on creation of specific channel types
Résumé
Zulip Server has access control bypass for restrictions on creation of specific channel types
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanism can be circumvented by creating a private or web-public channel, and then changing the channel privacy to public. A similar technique works for creating private channels without permission, though such a process requires either the API or modifying the HTML, as we do mark the "private" radio button as disabled in such cases. Version 10.3 contains a patch.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web zulip.com
- web zulip.readthedocs.io