GHSA-cvw9-c57h-3397

Source

https://github.com/advisories/GHSA-cvw9-c57h-3397

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-cvw9-c57h-3397/GHSA-cvw9-c57h-3397.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cvw9-c57h-3397

Aliases

Related

CVE-2024-39683

Published

2024-07-05T20:03:55Z

Modified

2024-07-09T21:56:02Z

Severity

5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

ZITADEL Vulnerable to Session Information Leakage

Details

Impact

ZITADEL provides users the ability to list all user sessions of the current user agent (browser) by API and in the Console UI.

Due to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions.

Note that the Login UI was never affected and there was no possibility to take over such a session.

Patches

2.x versions are fixed on >= 2.55.1 2.54.x versions are fixed on >= 2.54.5 2.53.x versions are fixed on >= 2.53.8

ZITADEL recommends upgrading to the latest versions available in due course.

Workarounds

There is no workaround since a patch is already available.

References

https://github.com/zitadel/zitadel/pull/8231
https://discord.com/channels/927474939156643850/1254096852937347153
https://github.com/zitadel/zitadel/issues/8213

Questions

If you have any questions or comments about this advisory, please email us at security@zitadel.com

Credits

Thanks to @cybertransformer, @Avolicious, @AmirhoseinBrz and @srividyaj for finding and reporting the vulnerability.

Database specific

{
    "nvd_published_at": "2024-07-03T20:15:04Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-05T20:03:55Z"
}

References

Affected packages

Go / github.com/zitadel/zitadel

Package

Name: github.com/zitadel/zitadel; View open source insights on deps.dev
Purl: pkg:golang/github.com/zitadel/zitadel

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

2.53.8

Database specific

{
    "last_known_affected_version_range": "<= 2.53.7"
}

Go / github.com/zitadel/zitadel

Package

Name: github.com/zitadel/zitadel; View open source insights on deps.dev
Purl: pkg:golang/github.com/zitadel/zitadel

Affected ranges

Type: SEMVER
Events: Introduced

2.54.0

Fixed

2.54.5

Database specific

{
    "last_known_affected_version_range": "<= 2.54.4"
}