CVE-2019-18933 - In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account

Back Back to CVE browser

CRITICAL

In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account

Published Nov 21, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.35%

Description

In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/
x_refsource_CONFIRMVendor Advisory
https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6
x_refsource_MISCPatch

Link	Providers	Tags
https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/		x_refsource_CONFIRMVendor Advisory
https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6		x_refsource_MISCPatch

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Nov 21, 2019

Updated Aug 5, 2024

Reserved Nov 13, 2019

Link CVE-2019-18933

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-18933

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-18933