CVE-2019-18933
Last modified
CVE-2019-18933 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.. EPSS estimates a 1.35% chance of exploitation in the next 30 days.
Description
In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zulip | Zulip Server | >= 1.7.0, < 2.0.7 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-18933?
How severe is CVE-2019-18933?
How do I fix CVE-2019-18933?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-18928Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows …9.8
- CVE-2019-18929Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows …8.8
- CVE-2019-1893A vulnerability in Cisco Enterprise NFV Infrastructure Softw…7.8
- CVE-2019-18930Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows …8.8
- CVE-2019-18931Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows …8.8
- CVE-2019-18932log.c in Squid Analysis Report Generator (sarg) through 2.3.…7
- CVE-2019-18934Unbound 1.6.4 through 1.9.4 contain a vulnerability in the i…7.3
- CVE-2019-18935Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 con…9.8
- CVE-2019-18936UniValue::read() in UniValue before 1.0.5 allow attackers to…7.5
- CVE-2019-18937eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script…9.8
- CVE-2019-18938eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail…9.8
- CVE-2019-18939eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Pri…9.8
Are you affected by CVE-2019-18933?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST