PT-2023-29231 · Zitadel · Zitadel

Hoseph · Publicado 2023-10-10 · Atualizado 2023-10-23 · CVE-2023-44399

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.37.2 and prior

Description ZITADEL provides identity infrastructure. The issue arises from the "Ignoring unknown usernames" setting, which is intended to mitigate attacks that try to guess or enumerate usernames. Although this setting works correctly during the authentication process, it fails to work as expected on the password reset flow. As a result, even with this feature active, an attacker can use the password reset function to verify if an account exists within ZITADEL.

Recommendations For ZITADEL versions 2.37.2 and prior, update to version 2.37.3 or 2.38.0 to resolve the issue. As a temporary workaround, consider restricting access to the password reset function until the update is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2023-44399

GHSA-V683-RCXX-VPFF

Produtos afetados

Zitadel

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44399.json · Exploit
• https://github.com/zitadel/zitadel · Nota
• https://github.com/zitadel/zitadel/releases/tag/v2.38.0 · Nota
• https://github.com/zitadel/zitadel/security/advisories/GHSA-v683-rcxx-vpff · Aviso do Fabricante
• https://github.com/zitadel/zitadel/releases/tag/v2.37.3 · Nota
• https://osv.dev/vulnerability/CVE-2023-44399 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-44399 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-v683-rcxx-vpff · Aviso do Fabricante
• https://t.me/cvenotify/59190 · Publicação no Telegram