Lucene search

MitreCVE-2021-30477

HistoryApr 15, 2021 - 12:15 a.m.

CVE-2021-30477

2021-04-1500:15:13

mitre

web.nvd.nist.gov

cve-2021-30477

zulip server

security issue

outgoing webhook

unauthorized messages

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to.

Affected configurations

Nvd

Node

zulipzulip_serverRange<3.4

VendorProductVersionCPE
zulipzulip_server*cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zulip	zulip_server	*	cpe:2.3:a:zulip:zulip_server::::::::

References

blog.zulip.com/2021/04/14/zulip-server-3-4/

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2021-30477