CVE-2019-16216

Severity Score

5.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack is only effective against browsers lacking support for Content-Security-Policy such as Internet Explorer 11. On a Zulip server using the S3 uploads backend, the attack is confined to the origin of the configured S3 uploads hostname and cannot reach the Zulip server itself.

El servidor Zulip versiones anteriores a 2.0.5, validó de manera incompleta los tipos MIME de archivos cargados. Un usuario que haya iniciado sesión en el servidor podría cargar archivos de ciertos tipos para montar un ataque de tipo cross-site scripting almacenado sobre otros usuarios registrados. En un servidor Zulip que usa el backend de carga local predeterminado, el ataque solo es efectivo contra los navegadores que carecen de soporte para Content-Security-Policy como Internet Explorer versión 11. En un servidor Zulip usando el backend de carga S3, el ataque es confinado en el origen del hostname de carga S3 configurado y no puede alcanzar al servidor Zulip en sí.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-09-11 CVE Reserved
2019-09-18 CVE Published
2024-08-05 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://github.com/zulip/zulip/commit/1195841dfb9aa26b3b0dabc6f05d72e4af25be3e	2019-09-18

URL	Date	SRC
https://blog.zulip.org/2019/09/11/zulip-server-2-0-5-security-release	2019-09-18

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Zulip Search vendor "Zulip"		Zulip Server Search vendor "Zulip" for product "Zulip Server"				>= 1.8.0 < 2.0.5 Search vendor "Zulip" for product "Zulip Server" and version " >= 1.8.0 < 2.0.5"		-		Affected