CVE-2016-4427 Auth bypass in zulip
Deactivated users can access messages in Zulip when Single Sign-On is enabled, allowing unauthorized data disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-4427?
CVE-2016-4427 is a high-severity authentication bypass vulnerability in zulip, published on 28 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.
Weakness: CWE-284
Which versions are affected by CVE-2016-4427?
It affects 1 product.
Products include Zulip Zulip.
How do I fix CVE-2016-4427?
No fix has been published for CVE-2016-4427 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-4427 being exploited?
There is no known exploitation of CVE-2016-4427 in the wild and no public exploit code.
Other vulnerabilities in zulip
- CVE-2021-43799 RabbitMQ exposes ports with weak default secrets in Zulip Server
- CVE-2022-35962 Crafted link in Zulip message can cause disclosure of credentials
- CVE-2021-3866 Cross-site Scripting (XSS) - Stored in zulip/zulip
- CVE-2023-28623 Unauthorized user can register an account in specific configurations in Zulip
- CVE-2021-43791 Ineffective expiration validation for invitation links in Zulip
Sources
Also known as GHSA-58ww-8hxm-f99f.