CVE-2021-30477

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Apr 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-304784.3An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_CVE-2021-304795.3An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest userCVE-2021-30485.9Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This coCVE-2021-304808.8Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interCVE-2021-304819.0Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because oCVE-2021-304827.5In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctlyCVE-2021-304835.3isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.CVE-2021-304856.5An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML file, performs incorrecCVE-2021-304868.8SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (PCVE-2021-304872.7In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizatCVE-2021-30494.3An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with iCVE-2021-304907.8upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Aut
CVE-2021-30477: Medium severity, CVSS 4.3 | Vulnix