CVE-2021-30477

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-30477
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-30477.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-30477
Published
2021-04-15T00:15:13.047Z
Modified
2026-07-09T00:14:01.574565Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to.

References

Affected packages

Git / github.com/zulip/zulip

Affected ranges

Type
GIT
Repo
https://github.com/zulip/zulip
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
974b95b0956e6be5ef43683fbfac951d6460c802
Database specific 
{
    "cpe": "cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.4"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

1.*
1.3.0
1.3.1
1.3.10
1.3.11
1.3.13
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.4.0
1.5.0
1.6.0
1.7.0
1.8.0
1.8.0-rc1
1.9.0
1.9.0-rc2
1.9.0-rc3
2.*
2.0.0
2.0.0-rc1
2.1-dev
2.1.0
2.1.0-rc1
2.2-dev
3.*
3.0
3.0-dev
3.0-rc1
3.0-rc2
3.1
3.2
3.3
4.*
4.0-dev
enterprise-1.*
enterprise-1.1.5
enterprise-1.2.0
shared-0.*
shared-0.0.1
shared-0.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-30477.json"