CVE-2022-31017 - CVE House
Back to Database
Status published Low CVE-2022-31017

Expression Always True vulnerability in Zulip Server

Vulnerability Description

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the server to incorrectly send an API event that includes the edited message to all of the stream’s current subscribers. This API event is ignored by official clients, but can be observed by using a modified client or the browser’s developer tools. This bug will be fixed in Zulip Server 5.3. There are no known workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-31017

Credits & Attribution

No credits recorded in the NVD database.

References

More from zulip

View All →
CVE-2025-52559
Zulip XSS in digest preview URL
Medium 6.8
CVE-2025-47930
Zulip Server has access control bypass for restrictions on creation of specific channel types
Medium 5.3
CVE-2025-31478
Zulip Authentication Backend Configuration Bypass
High 8.2
CVE-2025-30369
Zulip allows the deletion of Custom profile fields by administrators of a different organization
Low 2.7
CVE-2025-30368
Zulip allows the deletion of organization by administrators of a different organization
Low 2.7

Affected Vendor

Affected Software

zulip
Vulnerable Versions:
>= 2.1.0, < 5.3

Timeline

Official Publish: June 25th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-571 CWE-670

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.