PT-2023-29231 · Zitadel · Zitadel

Hoseph · Published 2023-10-10 · Updated 2023-10-23 · CVE-2023-44399

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.37.2 and prior

Description ZITADEL provides identity infrastructure. The issue arises from the "Ignoring unknown usernames" setting, which is intended to mitigate attacks that try to guess or enumerate usernames. Although this setting works correctly during the authentication process, it fails to work as expected on the password reset flow. As a result, even with this feature active, an attacker can use the password reset function to verify if an account exists within ZITADEL.

Recommendations For ZITADEL versions 2.37.2 and prior, update to version 2.37.3 or 2.38.0 to resolve the issue. As a temporary workaround, consider restricting access to the password reset function until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2023-44399

GHSA-V683-RCXX-VPFF

Affected Products

Zitadel

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44399.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-v683-rcxx-vpff · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44399 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44399 · Security Note
• https://osv.dev/vulnerability/GHSA-v683-rcxx-vpff · Vendor Advisory
• https://github.com/zitadel/zitadel · Note
• https://github.com/zitadel/zitadel/releases/tag/v2.38.0 · Note
• https://github.com/zitadel/zitadel/releases/tag/v2.37.3 · Note
• https://t.me/cvenotify/59190 · Telegram Post