ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel
ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/zitadel/zitadel from v2.0.0 before v2.53.8, from v2.54.0 before v2.54.5, from v2.55.0 before v2.55.1.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-39683US | medium6.5 | — | ||
ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Starting in version 2.53.0… | ||||
references
External citations — patches, advisories, analysis.
- https://discord.com/channels/927474939156643850/1254096852937347153WEB
- https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04FIX
- https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3daFIX
- https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73FIX
- https://github.com/zitadel/zitadel/issues/8213REPORT
- https://github.com/zitadel/zitadel/pull/8231FIX
- https://github.com/zitadel/zitadel/releases/tag/v2.53.8WEB
- https://github.com/zitadel/zitadel/releases/tag/v2.54.5WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan