CVE-2022-35962 HIGH

CVE-2022-35962: Crafted link in Zulip message can cause disclosure of credentials

Vendor Zulip
Product zulip-mobile
Weakness CWE-184
Published August 29, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

8.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sent by an authenticated user could lead to credential disclosure if a user follows the link. A patch was released in version 27.190.

Key dates

02Disclosure timeline

August 29, 2022 CVE published
April 23, 2025 Record updated