CVE-2022-31017

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-31017

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31017.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-31017

Aliases

GHSA-m5j3-jp59-6f3q

Published

2022-06-25T08:15:16Z

Modified

2026-07-15T01:49:19.634185344Z

Severity

2.0 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Expression Always True vulnerability in Zulip Server

Details

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the server to incorrectly send an API event that includes the edited message to all of the stream’s current subscribers. This API event is ignored by official clients, but can be observed by using a modified client or the browser’s developer tools. This bug will be fixed in Zulip Server 5.3. There are no known workarounds.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31017.json",
    "cwe_ids": [
        "CWE-571",
        "CWE-670"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/zulip/zulip

Affected ranges

Type

GIT

Repo

https://github.com/zulip/zulip

Events

Introduced

03a3ae8b61bd44bb1be06c9af04eeb607fa94d8f

Fixed

3c7fdf8a82004627afb21185a2066f18522273bb

Database specific

{
    "cpe": "cpe:2.3:a:zulip:zulip:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "5.3"
        }
    ]
}

Affected versions

2.*

2.1.0

2.2-dev

3.*

3.0

3.0-dev

3.0-rc1

3.0-rc2

4.*

4.0

4.0-dev

5.*

5.0

5.0-dev

5.1

5.2

shared-0.*

shared-0.0.3

shared-0.0.4

shared-0.0.5

shared-0.0.6

shared-0.0.7

shared-0.0.8

shared-0.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31017.json"