Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.
References
Link | Resource |
---|---|
https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/ | Vendor Advisory |
https://www.coresecurity.com/advisories/zulip-account-takeover-stored-xss | Exploit Third Party Advisory |
Configurations
Information
Published : 2020-04-20 13:15
Updated : 2020-04-28 11:57
NVD link : CVE-2020-10935
Mitre link : CVE-2020-10935
JSON object : View
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Products Affected
zulip
- zulip_server