CVE-2021-30487

In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.7 LOW
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
VendorProductVersion
zulipzulip_server
3.0 ≤
𝑥
< 3.4
𝑥
= Vulnerable software versions
References
https://blog.zulip.com/2021/04/14/zulip-server-3-4/
https://blog.zulip.com/2021/04/14/zulip-server-3-4/