High severity · published Mar 16, 2022
CVE-2022-24751
Race condition in Zulip
7.4
CVSS
1%
EPSS
No
On KEV
Description
Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A patch is available in version 4.11 on the 4.x branch and version 5.0-rc1 on the 5.x branch. Upgrading to a fixed version will, as a side effect, deactivate any cached sessions that may have been leaked through this bug. There are currently no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZU
zulip · zulip
>= 4.0, < 4.11 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24751
Patch
https://github.com/zulip/zulip/commit/62ba8e455d8f460001d9fb486a6dabfd1ed67717
Patch
https://github.com/zulip/zulip/commit/e6eace307ef435eec3395c99247155efed9219e4
Third Party Advisory
https://github.com/zulip/zulip/security/advisories/GHSA-6v98-m5x5-phqj
More from zulip
9.8
CVE-2022-21706
Multi-use invitations can grant access to other organizations in Zulip
9.8
CVE-2021-43799
RabbitMQ exposes ports with weak default secrets in Zulip Server
9.1
CVE-2026-102893
Zulip: OpenID Connect authentication ignores the email_verified claim
8.8
CVE-2022-31168
Zulip Server insufficient authorization for changing bot roles
8.8
CVE-2021-3967
Improper Access Control in zulip/zulip