CVE-2022-31017

LowCVSS 2.6/10Last modified Jun 17, 2026

Description

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the server to incorrectly send an API event that includes the edited message to all of the stream’s current subscribers. This API event is ignored by official clients, but can be observed by using a modified client or the browser’s developer tools. This bug will be fixed in Zulip Server 5.3. There are no known workarounds.

Metrics

CVSS 3.1 2.6/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-571 CWE-670

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-310187.5Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 CVE-2022-310197.5Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make th CVE-2022-310208.8Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-up CVE-2022-310215.3Ursa is a cryptographic library for use with blockchains. A weakness in the Hyperledger AnonCreds specification that is not mitigated in the CVE-2022-310225.5Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. Th CVE-2022-310237.5Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sens CVE-2022-310246.5richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.CVE-2022-310255.3Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` an CVE-2022-310267.5Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causi CVE-2022-310276.5OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, a CVE-2022-310287.5MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-0 CVE-2022-310294.8AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the