CVE-2022-31134

Name of the Vulnerable Software and Affected Versions Zulip Server versions 2.1.0 through 5.3

Description Zulip is an open-source team collaboration tool. It has a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. However, this export contains the attachment contents for all attachments, even those from private messages and streams, potentially allowing administrators to access private information they are not expected to have access to.

Recommendations For Zulip Server versions 2.1.0 through 5.3, update to version 5.4 to resolve the issue.