CVE-2023-33186

MEDIUM EPSS 45.1%
Published May 30, 20233y ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Medium
Find Similar
Published May 30, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
45.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 2

VendorProductVersionRange
zulipzulip_server7.0any
zulipzulip_server7.0any

References 4

  • github.com https://github.com/zulip/zulip/commit/03cfb3d9fe61c975d133121ec31a7357f0c9e18f
  • github.com https://github.com/zulip/zulip/commit/3ca131743b00f42bad8edbac4ef92656d954c629
    Patch
  • github.com https://github.com/zulip/zulip/pull/25370
    Issue TrackingPatch
  • github.com https://github.com/zulip/zulip/security/advisories/GHSA-4r83-8f94-hrph
    Vendor Advisory

Remediation

  • github.com https://github.com/zulip/zulip/commit/3ca131743b00f42bad8edbac4ef92656d954c629
    Patch
  • github.com https://github.com/zulip/zulip/pull/25370
    Issue TrackingPatch