Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This especially affects Zulip Desktop 2.3.82.
References
Link | Resource |
---|---|
https://blog.zulip.org/2020/02/29/zulip-desktop-4-0-3-security-release/ | Vendor Advisory |
Configurations
History
No history.
Information
Published : 2020-03-18 13:15
Updated : 2024-02-04 21:00
NVD link : CVE-2020-9443
Mitre link : CVE-2020-9443
CVE.ORG link : CVE-2020-9443
JSON object : View
Products Affected
zulipchat
- zulip_desktop
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')