Guests in organizations with restricted user visibility can gain access to profile information of other users
Résumé
Impact
In organizations that restrict guests' ability to view other users, using the
Who can view all other users in the organization organization setting, a guest
could gain access to the profile information of any user in the organization,
bypassing that restriction.
Organizations...
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| Zulip server |
>=8.0 |
12.2 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Impact
In organizations that restrict guests' ability to view other users, using the
Who can view all other users in the organization organization setting, a guest
could gain access to the profile information of any user in the organization,
bypassing that restriction.
Organizations that do not restrict guests' access to other users are unaffected.
This was possible since Zulip 8.0, when the setting was introduced.
Details
Saving a direct message draft did not verify that the sender is allowed to access
the draft's recipients.
Patches
Fixed in Zulip server 12.2
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY zulip/zulip