Design/Logic Flaw

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to...

Information disclosure

In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation...

CVE-2021-30479

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the allpublicstreams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization...

Design/Logic Flaw

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the allpublicstreams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization...

CVE-2021-30478

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the canforgesender permission previously isapisuperuser resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same...

CVE-2021-30477

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to...

CVE-2021-30479

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the allpublicstreams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization...

CVE-2021-30479

CVE-2021-30479 affects Zulip Server prior to 3.4, where a bug in the all_public_streams API allowed guest users to receive message traffic from public streams that should be restricted to organization members. This could enable unintended exposure of public-stream content to non-members. Multiple...

CVE-2021-30478

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the canforgesender permission previously isapisuperuser resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the same...

CVE-2021-30478

Summary: CVE-2021-30478 affects Zulip Server before 3.4. A bug in the can_forge_sender permission (formerly is_api_super_user) allows users with that permission to send messages that appear to come from a system bot, including to other organizations on the same Zulip deployment. The issue is root...

CVE-2021-30477

CVE-2021-30477 affects Zulip Server prior to 3.4. A bug in the handling of replies to messages sent by outgoing webhooks to private streams allowed an outgoing webhook bot to send messages to private streams that a user was not intended to reach. The impact described is the ability to post to res...

CVE-2021-30477

An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to...

CVE-2021-30487

In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation...

CVE-2021-30487

Technical details about CVE-2021-30487 are not provided in the connected documents. No explicit affected versions, root cause, impact, or fixes are described beyond the initial summary. Monitor for updates.

Zulip 访问控制错误漏洞

Zulip server is an open source team chat application from the American company Zulip. An Access Control Error vulnerability exists in versions of Zulip Server prior to 3.4, which results in a user with this privilege being able to send messages. No details of the vulnerability are provided at thi...

Zulip 访问控制错误漏洞

Zulip server is an open source team chat application from the American company Zulip. An access control error vulnerability exists in versions of Zulip Server prior to 3.4, which stems from a bug in the implementation of replies to messages that send a webhook to a private stream.No details of th...

Zulip 安全漏洞

Zulip server is an open source team chat application from the American company Zulip. A security vulnerability exists in version 3.x prior to Zulip Server 3.4, which stems from the ability of an organization administrator to move messages to streams in other organizations hosted by the same Zulip...

Zulip 安全漏洞

Zulip server is an open source team chat application from the American company Zulip. A security vulnerability exists in Zulip Server versions prior to 3.4 that stems from a public API that causes guest users to be able to receive message traffic from a public stream that should only be accessibl...

Zulip Desktop License Issue Vulnerability

Zulip Desktop is a desktop version of the team chat application from Zulip USA. An authorization issue vulnerability exists in versions prior to Zulip Desktop 5.0.0, which stems from allowing an attacker to record from a webcam and microphone because of an unprivileged request processor...

Zulip Desktop Remote Code Execution Vulnerability

Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Desktop is the Zulip desktop client. A remote code execution vulnerability exists in Zulip Desktop versions prior to 5.0.0. The...