Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2024-46999

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
20/09/2024
Last modified:
24/09/2024

Description

Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still provided in token, which could lead to unauthorized access to applications and resources. Additionally, the management and auth API always returned the state as active or did not provide any information about the state. Versions 2.62.1, 2.61.1, 2.60.2, 2.59.3, 2.58.5, 2.57.5, 2.56.6, 2.55.8, and 2.54.10 have been released which address this issue. Users are advised to upgrade. Users unable to upgrade may explicitly remove the user grants to make sure the user does not get access anymore.

Impact

Vector 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS v3.1 Severity and Metrics:

Base Score: 6.50 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): None
Availability (A): None

Base Score 3.x
6.50
Severity 3.x
MEDIUM

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* 2.54.10 (excluding)
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* 2.55.0 (including) 2.55.8 (excluding)
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* 2.56.0 (including) 2.56.6 (excluding)
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* 2.57.0 (including) 2.57.5 (excluding)
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* 2.58.0 (including) 2.58.5 (excluding)
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* 2.59.0 (including) 2.59.3 (excluding)
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* 2.60.0 (including) 2.60.2 (excluding)
cpe:2.3:a:zitadel:zitadel:2.61.0:*:*:*:*:*:*:*
cpe:2.3:a:zitadel:zitadel:2.62.0:*:*:*:*:*:*:*

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools