CVE-2021-30478

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same Zulip installation.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Apr 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-304795.3An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest userCVE-2021-30485.9Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This coCVE-2021-304808.8Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interCVE-2021-304819.0Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because oCVE-2021-304827.5In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctlyCVE-2021-304835.3isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.CVE-2021-304856.5An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML file, performs incorrecCVE-2021-304868.8SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (PCVE-2021-304872.7In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizatCVE-2021-30494.3An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with iCVE-2021-304907.8upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an AutCVE-2021-304935.5Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBr
CVE-2021-30478: Medium severity, CVSS 4.3 | Vulnix