CVE-2024-56136

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-56136
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56136.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-56136
Aliases
  • GHSA-5xg8-xhfj-4hm6
Published
2025-01-16T20:15:33Z
Modified
2025-01-17T09:12:03.958627Z
Summary
[none]
Details

Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclose attack, where, if a Zulip server is hosting multiple organizations, an unauthenticated user can make a request and determine if an email address is in use by a user. Zulip Server 9.4 resolves the issue, as does the main branch of Zulip Server. Users are advised to upgrade. There are no known workarounds for this issue.

References

Affected packages

Git / github.com/zulip/zulip

Affected ranges

Type
GIT
Repo
https://github.com/zulip/zulip
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

1.*

1.3.0
1.3.1
1.3.10
1.3.11
1.3.12
1.3.13
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.4.0
1.5.0
1.6.0
1.7.0
1.8.0
1.8.0-rc1
1.9.0
1.9.0-rc2
1.9.0-rc3

2.*

2.0.0
2.0.0-rc1
2.1-dev
2.1.0
2.1.0-rc1
2.2-dev

3.*

3.0
3.0-dev
3.0-rc1
3.0-rc2

4.*

4.0
4.0-dev

5.*

5.0
5.0-dev

6.*

6.0
6.0-dev

7.*

7.0
7.0-beta3
7.0-dev

8.*

8.0
8.0-beta1
8.0-beta2
8.0-dev

9.*

9.0
9.0-beta1
9.0-dev
9.1
9.2
9.3

enterprise-1.*

enterprise-1.1.5
enterprise-1.2.0

shared-0.*

shared-0.0.1
shared-0.0.10
shared-0.0.11
shared-0.0.12
shared-0.0.13
shared-0.0.14
shared-0.0.15
shared-0.0.16
shared-0.0.17
shared-0.0.18
shared-0.0.2
shared-0.0.3
shared-0.0.4
shared-0.0.5
shared-0.0.6
shared-0.0.7
shared-0.0.8
shared-0.0.9