CVE-2022-35962CWE-184CWE-436

Crafted link in Zulip message can cause disclosure of credentials

High · published August 29, 2022

CVSS v3.1
8.0
EPSS
1%
Percentile
65.9
In the wild
Unconfirmed
What it is

Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sent by an authenticated user could lead to credential disclosure if a user follows the link. A patch was released in version 27.190.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01119 · 65.9th percentile
Weaknesses
CWE-184 · Incomplete List of Disallowed Inputs; CWE-436 · Interpretation Conflict
Published
2022-08-29T14:50Z
EPSS history
Timeline
  • 29 AUG 14:50Z
    Crafted link in Zulip message can cause disclosure of credentials
    cvelistv5