PT-2024-28623 · Zitadel · Zitadel

Amirhoseinbrz + 3 · Published 2024-07-03 · Updated 2025-01-08 · CVE-2024-39683

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.0.0 through 2.53.7 ZITADEL versions 2.54.0 through 2.54.4 ZITADEL versions 2.55.0 through 2.55.0

Description ZITADEL is an open-source identity infrastructure tool that provides users the ability to list all user sessions of the current user agent. Due to a missing check, user sessions without that information were incorrectly listed, exposing potentially other user's sessions. The issue affects the API and Console UI, but not the Login UI. There is no possibility to take over such a session.

Recommendations For ZITADEL versions 2.0.0 through 2.53.7, upgrade to version 2.53.8 or later. For ZITADEL versions 2.54.0 through 2.54.4, upgrade to version 2.54.5 or later. For ZITADEL versions 2.55.0, upgrade to version 2.55.1 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-39683

GHSA-CVW9-C57H-3397

GO-2024-2968

Affected Products

Zitadel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39683.json · Exploit
• https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04 · Patch
• https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397 · Vendor Advisory
• https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3da · Patch
• https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-39683 · Security Note
• https://osv.dev/vulnerability/GHSA-cvw9-c57h-3397 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39683 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2968 · Vendor Advisory
• https://github.com/zitadel/zitadel · Note
• https://github.com/zitadel/zitadel/pull/8231 · Note
• https://github.com/zitadel/zitadel/releases/tag/v2.53.8 · Note
• https://github.com/zitadel/zitadel/releases/tag/v2.55.1 · Note
• https://github.com/zitadel/zitadel/releases/tag/v2.54.5 · Note
• https://github.com/zitadel/zitadel/issues/8213 · Note