Amit Laish

**Name of the Vulnerable Software and Affected Versions** ZITADEL versions 4.0.0 through 4.11.1 **Description** ZITADEL, an open source identity management platform, has a flaw in its login V2 interface that could allow for account takeover via Default URI Redirect. An unauthenticated remote attacker can exploit a Stored XSS vulnerability to reset passwords and take over accounts. This is due to missing restrictions and improper handling of the default redirect URI, allowing malicious JavaScript code to be executed in the Zitadel login UI. The issue is mitigated for accounts with Multi-Factor Authentication (MFA) or Passwordless authentication enabled. The vulnerable component is the login V2 interface. **Recommendations** Upgrade to version 4.12.0 or later.

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified) Description: A vulnerability in the VPN web client services feature could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. This issue is due to improper validation of user-supplied input to application endpoints. An attacker could exploit this by persuading a user to follow a link designed to submit malicious input to the affected application, potentially allowing the attacker to execute arbitrary HTML or script code in the browser in the context of the web services page. Recommendations: For Cisco Adaptive Security Appliance (ASA) Software, update to a version that includes the fix for this issue. For Cisco Firepower Threat Defense (FTD) Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the VPN web client services feature until a patch is available. Avoid using links from untrusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** datahub-helm versions 0.1.143 through 0.2.181 **Description** The issue is related to the use of a default cryptographic key in the helm chart for deploying Datahub in a Kubernetes cluster. If there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during the window of releases. Most deployments probably did not attempt to circumvent the helm settings to enable Metadata Service Authentication during this time, so impact is most likely limited. Any deployments with Metadata Service Authentication enabled should ensure that their secret values are properly randomized. **Recommendations** For versions 0.1.143 through 0.2.181, update to version 0.2.182 or later, which contains a patch for this issue. As a temporary workaround, reset the token signing key to be a random value, which will invalidate active personal access tokens. For deployments with Metadata Service Authentication enabled, ensure that secret values are properly randomized.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions prior to 3.0.3 **Description** A stored cross-site scripting (XSS) vulnerability exists in Apache Superset. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. This could allow a remote attacker to conduct cross-site scripting attacks. **Recommendations** For versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue. For 2.X versions, users should change their config to include the specified TALISMAN CONFIG settings to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions prior to 3.0.0 **Description** An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header. Users could be redirected to this site when clicking on that specific dataset. **Recommendations** For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue. As a temporary workaround, consider restricting the update datasets permission to trusted users until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions prior to 3.0.0 **Description** The issue allows an authenticated malicious user to initiate multiple concurrent requests, each requesting multiple dashboard exports. This could lead to a possible denial of service. **Recommendations** For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Jena versions prior to 4.4.0 **Description** A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects versions prior to 4.4.0, excluding Apache Jena 4.2.x and 4.3.x, which do not allow external entities. **Recommendations** For Apache Jena versions prior to 4.4.0, update to a version that is not affected by this issue. As a temporary workaround, consider disabling the RDF/XML parser until a patch is available. Restrict access to external DTDs to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** UAA server versions prior to 75.4.0 **Description** The issue allows a malicious user to exploit an open redirect vulnerability through social engineering, potentially leading to the takeover of victims' accounts and redirection of UAA users to malicious sites. **Recommendations** For UAA server versions prior to 75.4.0, update to version 75.4.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Atlassian Confluence Server versions prior to 7.4.10 Atlassian Confluence Server versions 7.5.0 through 7.12.3 **Description** The issue allows remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the "/s/" endpoint. This is related to authorization errors. Exploitation of the issue may allow a remote attacker to read arbitrary files. **Recommendations** For versions prior to 7.4.10, update to version 7.4.10 or later. For versions 7.5.0 through 7.12.3, update to version 7.12.3 or later. As a temporary workaround, consider restricting access to the "/s/" endpoint until a patch is available.

Name of the Vulnerable Software and Affected Versions: keycloak versions prior to 13.0.0 Description: A flaw in keycloak allows for a Self Stored XSS attack vector, which can escalate to a complete account takeover. This is due to user-supplied data fields not being properly encoded and the use of Javascript code to process the data. The highest threat from this issue is to data confidentiality and integrity, as well as system availability. Recommendations: For versions prior to 13.0.0, update to version 13.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of user-supplied data fields in Javascript code until a patch is available. Restrict access to sensitive data and functions to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Crowd versions prior to 4.0.4 Crowd versions 4.1.0 through 4.1.1 Description: The issue allows unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check in the ResourceDownloadRewriteRule class. Recommendations: For versions prior to 4.0.4, update to version 4.0.4 or later. For versions 4.1.0 through 4.1.1, update to version 4.1.2 or later.

Name of the Vulnerable Software and Affected Versions: Jira Server and Jira Data Center versions prior to 8.5.11 Jira Server and Jira Data Center versions 8.6.0 through 8.13.3 Jira Server and Jira Data Center versions 8.14.0 through 8.14.x Description: The issue allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check in the CachingResourceDownloadRewriteRule class. Recommendations: For versions prior to 8.5.11, update to version 8.5.11 or later. For versions 8.6.0 through 8.13.3, update to version 8.13.3 or later. For versions 8.14.0 through 8.14.x, update to version 8.15.0 or later.

Name of the Vulnerable Software and Affected Versions: Confluence Server versions prior to 6.13.18 Confluence Server versions 6.14.0 through 7.4.5 Confluence Server versions 7.5.0 through 7.8.2 Confluence Data Center versions prior to 6.13.18 Confluence Data Center versions 6.14.0 through 7.4.5 Confluence Data Center versions 7.5.0 through 7.8.2 Description: The issue allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. This was due to a problem in the ConfluenceResourceDownloadRewriteRule class. Recommendations: For Confluence Server versions prior to 6.13.18, update to version 6.13.18 or later. For Confluence Server versions 6.14.0 through 7.4.5, update to version 7.4.6 or later. For Confluence Server versions 7.5.0 through 7.8.2, update to version 7.8.3 or later. For Confluence Data Center versions prior to 6.13.18, update to version 6.13.18 or later. For Confluence Data Center versions 6.14.0 through 7.4.5, update to version 7.4.6 or later. For Confluence Data Center versions 7.5.0 through 7.8.2, update to version 7.8.3 or later.

**Name of the Vulnerable Software and Affected Versions** Cloud Foundry UAA versions prior to 74.3.0 **Description** The issue concerns an endpoint vulnerable to SCIM injection attack. A remote authenticated malicious user with `scim.invite` scope can craft a request with malicious content, potentially leaking information about users of the UAA. **Recommendations** For versions prior to 74.3.0, update to version 74.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the `scim.invite` scope to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CF UAA versions prior to 74.1.0 **Description** A remote malicious user can escalate their own privileges to any scope by submitting an array of requested scopes, allowing them to take control of UAA and the resources it controls. **Recommendations** For CF UAA versions prior to 74.1.0, update to version 74.1.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** CF UAA versions prior to 74.1.0 **Description** The issue allows a remote malicious user with 'client.write' and 'groups.update' permissions to craft a SCIM query, which leaks information that enables an escalation of privileges. This ultimately allows the malicious user to gain control of UAA scopes they should not have. **Recommendations** For CF UAA versions prior to 74.1.0, update to version 74.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the 'client.write' and 'groups.update' permissions to minimize the risk of exploitation.