CVE-2025-25195

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-25195", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-02-03T19:30:53.400Z", "datePublished": "2025-02-13T21:47:24.651Z", "dateUpdated": "2025-02-14T15:46:45.940Z"}, "containers": {"cna": {"title": "Zulip events can leak private channel names", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/zulip/zulip/security/advisories/GHSA-x8cx-3hq5-4wj9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zulip/zulip/security/advisories/GHSA-x8cx-3hq5-4wj9"}, {"name": "https://github.com/zulip/zulip/commit/50256f48314250978f521ef439cafa704e056539", "tags": ["x_refsource_MISC"], "url": "https://github.com/zulip/zulip/commit/50256f48314250978f521ef439cafa704e056539"}, {"name": "https://github.com/zulip/zulip/commit/75be449d456d29fef27e9d1828bafa30174284b4", "tags": ["x_refsource_MISC"], "url": "https://github.com/zulip/zulip/commit/75be449d456d29fef27e9d1828bafa30174284b4"}, {"name": "https://github.com/zulip/zulip/commit/a2a1a7f8d152296c8966f1380872c0ac69e5c87e", "tags": ["x_refsource_MISC"], "url": "https://github.com/zulip/zulip/commit/a2a1a7f8d152296c8966f1380872c0ac69e5c87e"}], "affected": [{"vendor": "zulip", "product": "zulip", "versions": [{"version": ">= 50256f48314250978f521ef439cafa704e056539, < 75be449d456d29fef27e9d1828bafa30174284b4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-02-13T21:47:24.651Z"}, "descriptions": [{"lang": "en", "value": "Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being \"inactive\" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in the channel. This event contained the name of the private channel. Similarly, the same commit (50256f48314250978f521ef439cafa704e056539) added functionality to notify clients when channels stopped being \"inactive.\" The first message sent to a private channel which had not previously had any messages for over 180 days (and were thus already marked \"inactive\") would leak an event to all users in the organization; this event also contained the name of the private channel. Commits 75be449d456d29fef27e9d1828bafa30174284b4 and a2a1a7f8d152296c8966f1380872c0ac69e5c87e fixed the issue. This vulnerability only existed in `main`, and was not part of any published versions."}], "source": {"advisory": "GHSA-x8cx-3hq5-4wj9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-14T15:36:44.058401Z", "id": "CVE-2025-25195", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-14T15:46:45.940Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-25195", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-14T15:36:44.058401Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-14T15:36:45.676Z"}}], "cna": {"title": "Zulip events can leak private channel names", "source": {"advisory": "GHSA-x8cx-3hq5-4wj9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "zulip", "product": "zulip", "versions": [{"status": "affected", "version": ">= 50256f48314250978f521ef439cafa704e056539, < 75be449d456d29fef27e9d1828bafa30174284b4"}]}], "references": [{"url": "https://github.com/zulip/zulip/security/advisories/GHSA-x8cx-3hq5-4wj9", "name": "https://github.com/zulip/zulip/security/advisories/GHSA-x8cx-3hq5-4wj9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zulip/zulip/commit/50256f48314250978f521ef439cafa704e056539", "name": "https://github.com/zulip/zulip/commit/50256f48314250978f521ef439cafa704e056539", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zulip/zulip/commit/75be449d456d29fef27e9d1828bafa30174284b4", "name": "https://github.com/zulip/zulip/commit/75be449d456d29fef27e9d1828bafa30174284b4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zulip/zulip/commit/a2a1a7f8d152296c8966f1380872c0ac69e5c87e", "name": "https://github.com/zulip/zulip/commit/a2a1a7f8d152296c8966f1380872c0ac69e5c87e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being \"inactive\" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in the channel. This event contained the name of the private channel. Similarly, the same commit (50256f48314250978f521ef439cafa704e056539) added functionality to notify clients when channels stopped being \"inactive.\" The first message sent to a private channel which had not previously had any messages for over 180 days (and were thus already marked \"inactive\") would leak an event to all users in the organization; this event also contained the name of the private channel. Commits 75be449d456d29fef27e9d1828bafa30174284b4 and a2a1a7f8d152296c8966f1380872c0ac69e5c87e fixed the issue. This vulnerability only existed in `main`, and was not part of any published versions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-02-13T21:47:24.651Z"}}}, "cveMetadata": {"cveId": "CVE-2025-25195", "state": "PUBLISHED", "dateUpdated": "2025-02-14T15:46:45.940Z", "dateReserved": "2025-02-03T19:30:53.400Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-02-13T21:47:24.651Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "zulip", "vendor": "zulip", "versions": [{"status": "affected", "version": ">= 50256f48314250978f521ef439cafa704e056539, < 75be449d456d29fef27e9d1828bafa30174284b4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being \"inactive\" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in the channel. This event contained the name of the private channel. Similarly, the same commit (50256f48314250978f521ef439cafa704e056539) added functionality to notify clients when channels stopped being \"inactive.\" The first message sent to a private channel which had not previously had any messages for over 180 days (and were thus already marked \"inactive\") would leak an event to all users in the organization; this event also contained the name of the private channel. Commits 75be449d456d29fef27e9d1828bafa30174284b4 and a2a1a7f8d152296c8966f1380872c0ac69e5c87e fixed the issue. This vulnerability only existed in `main`, and was not part of any published versions."}, {"lang": "es", "value": "Zulip es una aplicaci\u00f3n de chat en equipo de c\u00f3digo abierto. Un trabajo cron semanal (agregado en 50256f48314250978f521ef439cafa704e056539) degrada los canales a \"inactivos\" despu\u00e9s de que no hayan recibido tr\u00e1fico durante 180 d\u00edas. Sin embargo, al hacerlo, se envi\u00f3 un evento a todos los usuarios de la organizaci\u00f3n, no solo a los usuarios del canal. Este evento conten\u00eda el nombre del canal privado. De manera similar, el mismo commit (50256f48314250978f521ef439cafa704e056539) agreg\u00f3 una funcionalidad para notificar a los clientes cuando los canales dejaron de estar \"inactivos\". El primer mensaje enviado a un canal privado que no hab\u00eda tenido ning\u00fan mensaje previamente durante m\u00e1s de 180 d\u00edas (y, por lo tanto, ya estaba marcado como \"inactivo\") filtrar\u00eda un evento a todos los usuarios de la organizaci\u00f3n; este evento tambi\u00e9n conten\u00eda el nombre del canal privado. Los commits 75be449d456d29fef27e9d1828bafa30174284b4 y a2a1a7f8d152296c8966f1380872c0ac69e5c87e solucionaron el problema. Esta vulnerabilidad solo exist\u00eda en `main` y no formaba parte de ninguna versi\u00f3n publicada."}], "id": "CVE-2025-25195", "lastModified": "2026-06-17T09:00:27.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-25195", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-14T15:36:44.058401Z", "version": "2.0.3"}}]}, "published": "2025-02-13T22:15:13.100", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/zulip/zulip/commit/50256f48314250978f521ef439cafa704e056539"}, {"source": "security-advisories@github.com", "url": "https://github.com/zulip/zulip/commit/75be449d456d29fef27e9d1828bafa30174284b4"}, {"source": "security-advisories@github.com", "url": "https://github.com/zulip/zulip/commit/a2a1a7f8d152296c8966f1380872c0ac69e5c87e"}, {"source": "security-advisories@github.com", "url": "https://github.com/zulip/zulip/security/advisories/GHSA-x8cx-3hq5-4wj9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T15:26:13.511905+00:00", "updated": "2025-07-12T15:26:13.511954+00:00", "vendors": ["zulip", "zulip$PRODUCT$zulip"]}