Open Redirect Vulnerability in Zulip Server by Zulip
CVE-2019-19775

6.1MEDIUM

Key Information:

Vendor

Zulip

Status
Zulip Server
Vendor
CVE Published:
18 December 2019

What is CVE-2019-19775?

The image thumbnailing handler in Zulip Server versions 1.9.0 through prior to 2.0.8 has a vulnerability that permits open redirection. This issue manifests when users who are logged in utilize thumbnail links, potentially allowing malicious actors to redirect users to harmful sites.

References

https://github.com/zulip/zulip/commit/b7c87a4d82397a5e6ac...
x_refsource_CONFIRM
https://blog.zulip.org/2019/12/13/zulip-server-2-0-8-secu...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.