PT-2021-18757 · Zulip · Zulip Server

Published 2021-04-14 · Updated 2022-07-12 · CVE-2021-30487

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zulip Server versions 3.x before 3.4

Description The issue allows organization administrators to move messages to streams in other organizations hosted by the same Zulip installation, using the topic moving API.

Recommendations For Zulip Server versions 3.x before 3.4, update to version 3.4 or later to resolve the issue.

Fix

Related Identifiers

CVE-2021-30487

Affected Products

Zulip Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-30487 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30487 · Vendor Advisory
• https://blog.zulip.com/2021/04/14/zulip-server-3-4 · Vendor Advisory
• https://t.me/cvenotify/13239 · Telegram Post