CVE-2021-30479

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-30485.9Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This co CVE-2021-304808.8Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user inter CVE-2021-304819.0Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because o CVE-2021-304827.5In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly CVE-2021-304835.3isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.CVE-2021-304856.5An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML file, performs incorrec CVE-2021-304868.8SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (P CVE-2021-304872.7In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizat CVE-2021-30494.3An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with i CVE-2021-304907.8upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Aut CVE-2021-304935.5Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBr CVE-2021-304945.5Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Ch