API Bug in Zulip Server Allows Unauthorized Access to Public Stream Messages
CVE-2021-30479

5.3MEDIUM

Key Information:

Vendor

Zulip

Status
Zulip Server
Vendor
CVE Published:
15 April 2021

What is CVE-2021-30479?

A flaw was identified in Zulip Server that affects versions prior to 3.4, specifically in the all_public_streams API feature. This vulnerability allows guest users to receive message traffic from public streams that are intended solely for organization members. Such unauthorized access compromises the confidentiality of communications within the server, highlighting the importance of securing API endpoints to ensure proper access control.

References

https://blog.zulip.com/2021/04/14/zulip-server-3-4/
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.