CVE-2021-30487

EUVD-2021-17409
In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.7 LOW
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
Affected Products (NVD)
VendorProductVersion
zulipzulip_server
3.0 ≤
𝑥
< 3.4
𝑥
= Vulnerable software versions
References
https://blog.zulip.com/2021/04/14/zulip-server-3-4/
https://blog.zulip.com/2021/04/14/zulip-server-3-4/