Description (CNA)
Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/
- https://www.coresecurity.com/advisories/zulip-account-takeover-stored-xss
ADP enrichment
No English description supplied.