Log in Start free

Vulnerability · Published Jul 3, 2024 · Assigned by GitHub_M

CVE-2024-39683ZITADEL Vulnerable to Session Information Leakage

Medium 5.7

In plain English

A medium-severity information exposure in zitadel from zitadel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions. Versions 2.55.1, 2.54.5, and 2.53.8 contain a fix for the issue. There is no workaround since a patch is already available.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/zitadel/zitadel2.53.8GHSA-cvw9-c57h-3397
Gogithub.com/zitadel/zitadel2.54.5GHSA-cvw9-c57h-3397
Gogithub.com/zitadel/zitadel2.55.1GHSA-cvw9-c57h-3397
Gogithub.com/zitadel/zitadelno fix listedGO-2024-2968

Affected products (as reported)

VendorProductVersions
zitadel zitadel = 2.55.0>= 2.54.0, < 2.54.5>= 2.53.0, < 2.53.8

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

References