Lucene search

GoogleOSV:GO-2024-2968

HistoryJul 09, 2024 - 7:34 p.m.

ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

2024-07-0919:34:07

Google

osv.dev

zitadel

vulnerable

session information leakage

github

software

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

5.4

Confidence

High

JSON

ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel from v2.0.0 before v2.53.8, from v2.54.0 before v2.54.5, from v2.55.0 before v2.55.1.

References

discord.com/channels/927474939156643850/1254096852937347153

github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04

github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3da

github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73

github.com/zitadel/zitadel/issues/8213

github.com/zitadel/zitadel/pull/8231

github.com/zitadel/zitadel/releases/tag/v2.53.8

github.com/zitadel/zitadel/releases/tag/v2.54.5

github.com/zitadel/zitadel/releases/tag/v2.55.1

github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397

nvd.nist.gov/vuln/detail/CVE-2024-39683

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

5.4

Confidence

High

JSON

Related for OSV:GO-2024-2968