Vulnerability · Published Oct 10, 2023 · Assigned by GitHub_M
CVE-2023-44399ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting
Medium 5.3
In plain English
A medium-severity security flaw in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL. This bug has been patched in versions 2.37.3 and 2.38.0. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/zitadel/zitadel | 2.37.3 | GHSA-v683-rcxx-vpff |
Affected products (as reported)
Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/zitadel/zitadel/security/advisories/GHSA-v683-rcxx-vpff x_refsource_CONFIRM
- https://github.com/zitadel/zitadel/releases/tag/v2.37.3 x_refsource_MISC
- https://github.com/zitadel/zitadel/releases/tag/v2.38.0 x_refsource_MISC