PT-2024-32331 · Zitadel · Zitadel

Livio-A · Published 2024-09-19 · Updated 2024-09-26 · CVE-2024-46999

Positive Technologies (AI Summary)

CVSS v4.0

7.4

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zitadel versions prior to 2.54.10 Zitadel versions from 2.55.0 through 2.55.7 Zitadel versions from 2.56.0 through 2.56.5 Zitadel versions from 2.57.0 through 2.57.4 Zitadel versions from 2.58.0 through 2.58.4 Zitadel versions from 2.59.0 through 2.59.2 Zitadel versions from 2.60.0 through 2.60.1 Zitadel versions from 2.61.0 through 2.61.0 Zitadel versions from 2.62.0 through 2.62.0

Description Zitadel is an open source identity management platform. The user grants deactivation mechanism did not work correctly, allowing deactivated user grants to be provided in tokens. This could lead to unauthorized access to applications and resources. The management and auth API always returned the state as active or did not provide any information about the state.

Recommendations For versions prior to 2.54.10, upgrade to version 2.54.10 or later. For versions from 2.55.0 through 2.55.7, upgrade to version 2.55.8 or later. For versions from 2.56.0 through 2.56.5, upgrade to version 2.56.6 or later. For versions from 2.57.0 through 2.57.4, upgrade to version 2.57.5 or later. For versions from 2.58.0 through 2.58.4, upgrade to version 2.58.5 or later. For versions from 2.59.0 through 2.59.2, upgrade to version 2.59.3 or later. For versions from 2.60.0 through 2.60.1, upgrade to version 2.60.2 or later. For versions from 2.61.0 through 2.61.0, upgrade to version 2.61.1 or later. For versions from 2.62.0 through 2.62.0, upgrade to version 2.62.1 or later. As a temporary workaround, users unable to upgrade may explicitly remove the user grants to prevent unauthorized access.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-672

CWE-269

Related Identifiers

CVE-2024-46999

GHSA-2W5J-QFVW-2HF5

GO-2024-3137

Affected Products

Zitadel

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46999.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-2w5j-qfvw-2hf5 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3137 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-46999 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2w5j-qfvw-2hf5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46999 · Security Note
• https://github.com/zitadel/zitadel · Note
• https://twitter.com/cracbot/status/1838458424612548949 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1837043339989839922 · Twitter Post
• https://twitter.com/CVEnew/status/1836910774050013330 · Twitter Post
• https://t.me/cvenotify/95873 · Telegram Post