Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2022-31017 Details

Description

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the server to incorrectly send an API event that includes the edited message to all of the stream’s current subscribers. This API event is ignored by official clients, but can be observed by using a modified client or the browser’s developer tools. This bug will be fixed in Zulip Server 5.3. There are no known workarounds.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:2.6 LOWVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

CNA: [email protected]CVSS-B:2 LOWVector:CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/zulip/zulip/security/advisories/GHSA-m5j3-jp59-6f3q	CVE	Third Party Advisory
https://github.com/zulip/zulip/security/advisories/GHSA-m5j3-jp59-6f3q	[email protected]	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-571	Expression is Always True	[email protected]
CWE-670	Always-Incorrect Control Flow Implementation	[email protected]

Affected Products

Product	Versions
zulip zulip	>= 2.1.0, < 5.3
CPE cpe:2.3:a:zulip:zulip:::::::: Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jul 7, 2022	Initial Analysis	[email protected]