Zitadel Addresses Connection Issues in Latest Point Release
CVE-2024-32967

5.3MEDIUM

Key Information:

Vendor
Zitadel
Status
Zitadel
Vendor
CVE Published:
1 May 2024

Summary

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.

Affected Version(s)

zitadel < 2.45.7 < 2.45.7

zitadel >= 2.46.0,< 2.46.7 < 2.46.0, 2.46.7

zitadel >= 2.47.0, < 2.47.10 < 2.47.0, 2.47.10

References

https://github.com/zitadel/zitadel/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/zitadel/zitadel/commit/b918603b576d156...
x_refsource_MISC
https://github.com/zitadel/zitadel/releases/tag/v2.45.7
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-32967 : Zitadel Addresses Connection Issues in Latest Point Release | SecurityVulnerability.io