CVE-2021-30478
EUVD-2021-1740115.04.2021, 00:15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same Zulip installation.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| zulip | zulip_server | 𝑥 < 3.4 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration