CVE-2024-47060
Sept. 25, 2024, 4:43 p.m.
6.5
Medium
Description
Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to unauthorized access. Additionally, if a project was deactivated access to applications was also still possible. The issue stems from the fact that when an organization is deactivated in Zitadel, the applications associated with it do not automatically deactivate. The application lifecycle is not tightly coupled with the organization's lifecycle, leading to a situation where the organization or project is marked as inactive, but its resources remain accessible. This vulnerability allows for unauthorized access to projects and their resources, which should have been restricted post-organization deactivation. Versions 2.62.1, 2.61.1, 2.60.2, 2.59.3, 2.58.5, 2.57.5, 2.56.6, 2.55.8, and 2.54.10 have been released which address this issue. Users are advised to upgrade. Users unable to upgrade may explicitly disable the application to make sure the client is not allowed anymore.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Zitadel |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | zitadel | zitadel | / | / | / | / | / | / | / | / |
| a | zitadel | zitadel | / | / | / | / | / | / | / | / |
| a | zitadel | zitadel | / | / | / | / | / | / | / | / |
| a | zitadel | zitadel | / | / | / | / | / | / | / | / |
| a | zitadel | zitadel | / | / | / | / | / | / | / | / |
| a | zitadel | zitadel | / | / | / | / | / | / | / | / |
| a | zitadel | zitadel | / | / | / | / | / | / | / | / |
| a | zitadel | zitadel | 2.61.0 | / | / | / | / | / | / | / |
| a | zitadel | zitadel | 2.62.0 | / | / | / | / | / | / | / |
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: LOW
- Scope: UNCHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: NONE
- Availability Impact: NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Timeline
Published: Sept. 20, 2024, 12:15 a.m.
Last Modified: Sept. 25, 2024, 4:43 p.m.
Last Modified: Sept. 25, 2024, 4:43 p.m.
Status : Analyzed
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security-advisories@github.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.