{"cve":"CVE-2022-31134","nvd":{"published":"2022-07-12T21:15:09.910","modified":"2026-06-17T04:44:52.607","status":"Modified","description":"Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a \"public data\" export. While this export is only accessible to administrators, in many configurations server administrators are not expected to have access to private messages and private streams. However, the \"public data\" export which administrators could generate contained the attachment contents for all attachments, even those from private messages and streams. Zulip Server version 5.4 contains a patch for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.9},"cwes":["CWE-434","CWE-200"],"references":["https://blog.zulip.com/2022/07/12/zulip-cloud-data-exports","https://blog.zulip.com/2022/07/12/zulip-server-5-4-security-release","https://github.com/zulip/zulip/security/advisories/GHSA-58pm-88xp-7x9m","https://blog.zulip.com/2022/07/12/zulip-cloud-data-exports","https://blog.zulip.com/2022/07/12/zulip-server-5-4-security-release"],"products":["zulip:zulip_server"],"source":"nvd","synced_at":"2026-10-19T21:33:44.859608815+00:00"},"epss":{"cve":"CVE-2022-31134","score":0.00919,"percentile":0.60259,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}