CVEvulnerability

CVE-2022-41914

3.7 LOW Published 2022-11-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-203

Description

Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be possible for an attacker to infer the value of the token by performing a sophisticated timing analysis on a large number of failing requests. If successful, this would allow the attacker to impersonate the SCIM client for its abilities to read and update user accounts in the Zulip organization. Organizations where SCIM account management has not been enabled are not affected.

Affected configurations

• zulip zulip server (>= 5.0 < 5.7)

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-203 Observable Discrepancy weakness

References