Medium severity · published Jul 12, 2022
CVE-2022-31134
Zulip Server public data export contains attachments that are non-public
4.9
CVSS
0.9%
EPSS
No
On KEV
Description
Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many configurations server administrators are not expected to have access to private messages and private streams. However, the "public data" export which administrators could generate contained the attachment contents for all attachments, even those from private messages and streams. Zulip Server version 5.4 contains a patch for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZU
zulip · zulip
>= 2.1.0, < 5.4 · source: vendor
ZS
Zulip Server · Zulip
2.1.0 before 5.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31134
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31134
Vendor Advisory
https://blog.zulip.com/2022/07/12/zulip-cloud-data-exports
Release Notes
https://blog.zulip.com/2022/07/12/zulip-server-5-4-security-release
Release Notes
https://github.com/zulip/zulip/security/advisories/GHSA-58pm-88xp-7x9m
More from zulip
9.8
CVE-2022-21706
Multi-use invitations can grant access to other organizations in Zulip
9.8
CVE-2021-43799
RabbitMQ exposes ports with weak default secrets in Zulip Server
9.1
CVE-2026-102893
Zulip: OpenID Connect authentication ignores the email_verified claim
8.8
CVE-2022-31168
Zulip Server insufficient authorization for changing bot roles
8.8
CVE-2021-3967
Improper Access Control in zulip/zulip
