CVE-2021-30478: Medium severity zulip server vulnerability
Published Apr 14, 2021
·Updated
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the canforgesender permission (previously isapisuperuser) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same Zulip installation.
Affected Software
1 affected component
Zulip Server<3.4
Event History
Apr 14, 2021
CVE Published
via MITRE·11:47 PM
Data Sourced
via MITRE·11:47 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2021-30478.
2
What is the severity of CVE-2021-30478?
The severity of CVE-2021-30478 is medium with a CVSS score of 4.3.
3
What is the affected software version of CVE-2021-30478?
The affected software version of CVE-2021-30478 is Zulip Server up to version 3.4 (exclusive).
4
What is the CWE ID of CVE-2021-30478?
The CWE ID of CVE-2021-30478 is CWE-269.
5
How can I fix CVE-2021-30478?
To fix CVE-2021-30478, update Zulip Server to version 3.4 or higher.