XSS in Zulip
CVE-2023-33186
Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L.
EPSS exploit prediction
EPSS: 0.006 (48.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Zulip — versions >= 7.0-beta1, < 7.0-beta3
- Zulip Server — versions 7.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-33186?
- CVE-2023-33186 is a high-severity vulnerability in Zulip, classified under Cross-site Scripting. CVSS score: 8.2/10. Published 2023-05-30.
- How severe is CVE-2023-33186?
- High severity. CVSS v3 base score is 8.2 out of 10.