Guests in organizations with restricted user visibility can gain access to profile information of other users
概要
Impact
In organizations that restrict guests' ability to view other users, using the
Who can view all other users in the organization organization setting, a guest
could gain access to the profile information of any user in the organization,
bypassing that restriction.
Organizations...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| Zulip server |
>=8.0 |
12.2 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Impact
In organizations that restrict guests' ability to view other users, using the
Who can view all other users in the organization organization setting, a guest
could gain access to the profile information of any user in the organization,
bypassing that restriction.
Organizations that do not restrict guests' access to other users are unaffected.
This was possible since Zulip 8.0, when the setting was introduced.
Details
Saving a direct message draft did not verify that the sender is allowed to access
the draft's recipients.
Patches
Fixed in Zulip server 12.2
出典: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
参照URL
- GITHUB_REPO_ADVISORY zulip/zulip