PatchTheCVEzulip desktop vulnerabilities and fixes
Recent CVEs affecting zulip desktop, with upgrade or downgrade steps. 5 tracked.
Also searched as: zulipdesktop.
zulip desktop has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2021-02-05. Highest priority: CVE-2020-10857 (score 61/100).
- CVE-2020-9443 MEDIUM 6.1 UPGRADE Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which c
- CVE-2020-24582 MEDIUM 6.1 UPGRADE Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for
- CVE-2020-12637 CRITICAL 9.8 UPGRADE Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently dis
- CVE-2020-10858 MEDIUM 5.3 UPGRADE Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missin
- CVE-2020-10857 CRITICAL 9.8 UPGRADE Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leadi
FAQ
How do I fix zulip desktop vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zulip desktop being exploited right now?
None of the tracked zulip desktop CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zulip desktop CVE should I patch first?
CVE-2020-10857 currently ranks highest (61/100): Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leadi.