Zulip information disclosure | CVE-2021-43799
NAME
Zulip information disclosure
- Platforms Affected:
Zulip Zulip Server 4.8 - Risk Level:
8.6 - Exploitability:
Unproven - Consequences:
Obtain Information
DESCRIPTION
Zulip could allow a remote attacker to obtain sensitive information, caused by using weak default secrets in RabbitMQ ports. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS 3.0 Information
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Access Vector: Network
- Access Complexity: Low
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
- Remediation Level: Official Fix
MITIGATION
Refer to Zulip GIT Repository for patch, upgrade or suggested workaround information. See References.
- Reference Link:
https://github.com/zulip/zulip/security/advisories/GHSA-p663-wxvv-2fjp - Reference Link:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43799
