medium5.4
CVE-2020-10935
Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.
Impact
Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zulip | Zulip Server | before 2.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/
- https://www.coresecurity.com/advisories/zulip-account-takeover-stored-xss
- https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/
- https://www.coresecurity.com/advisories/zulip-account-takeover-stored-xss