Vulnerability-Lookup

CVE-2024-41953 (GCVE-0-2024-41953)

Vulnerability from cvelistv5 – Published: 2024-07-31 16:42 – Updated: 2024-08-01 13:48

Title

Zitadel improperly sanitizes HTML in emails and Console UI

Summary

Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email. On the user's detail page, the username was also not sanitized and would also render HTML, giving an attacker the same vulnerability. While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8 2.53.9, and 2.52.3.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/zitadel/zitadel/security/advis…	x_refsource_CONFIRM
	https://github.com/zitadel/zitadel/commit/0e1f99e…	x_refsource_MISC
	https://github.com/zitadel/zitadel/commit/38da602…	x_refsource_MISC
	https://github.com/zitadel/zitadel/commit/4b59cac…	x_refsource_MISC
	https://github.com/zitadel/zitadel/commit/c1a3fc7…	x_refsource_MISC
	https://github.com/zitadel/zitadel/commit/c353f82…	x_refsource_MISC
	https://github.com/zitadel/zitadel/commit/d04ac6d…	x_refsource_MISC
	https://github.com/zitadel/zitadel/commit/f846616…	x_refsource_MISC
	https://github.com/zitadel/zitadel/releases/tag/v2.52.3	x_refsource_MISC
	https://github.com/zitadel/zitadel/releases/tag/v2.53.9	x_refsource_MISC
	https://github.com/zitadel/zitadel/releases/tag/v2.54.8	x_refsource_MISC
	https://github.com/zitadel/zitadel/releases/tag/v2.55.5	x_refsource_MISC
	https://github.com/zitadel/zitadel/releases/tag/v2.56.2	x_refsource_MISC
	https://github.com/zitadel/zitadel/releases/tag/v2.57.1	x_refsource_MISC
	https://github.com/zitadel/zitadel/releases/tag/v2.58.1	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	zitadel	zitadel	Affected: >= 2.52.0, < 2.52.3 Affected: >= 2.53.0, < 2.53.9 Affected: >= 2.54.0, < 2.54.8 Affected: >= 2.55.0, < 2.55.5 Affected: >= 2.56.0, < 2.56.2 Affected: >= 2.57.0, < 2.57.1 Affected: >= 2.58.0, < 2.58.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41953",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-01T13:48:22.254696Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-01T13:48:32.705Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zitadel",
          "vendor": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.52.0, \u003c 2.52.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.53.0, \u003c 2.53.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.54.0, \u003c 2.54.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.55.0, \u003c 2.55.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.56.0, \u003c 2.56.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.57.0, \u003c 2.57.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.58.0, \u003c 2.58.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email. On the user\u0027s detail page, the username was also not sanitized and would also render HTML, giving an attacker the same vulnerability. While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8 2.53.9, and 2.52.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-31T16:42:33.125Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v2.52.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v2.52.3"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v2.53.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v2.53.9"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v2.54.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v2.54.8"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v2.55.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v2.55.5"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v2.56.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v2.56.2"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v2.57.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v2.57.1"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v2.58.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v2.58.1"
        }
      ],
      "source": {
        "advisory": "GHSA-v333-7h2p-5fhv",
        "discovery": "UNKNOWN"
      },
      "title": "Zitadel improperly sanitizes HTML in emails and Console UI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-41953",
    "datePublished": "2024-07-31T16:42:33.125Z",
    "dateReserved": "2024-07-24T16:51:40.949Z",
    "dateUpdated": "2024-08-01T13:48:32.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41953\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-01T13:48:22.254696Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-01T13:48:27.703Z\"}}], \"cna\": {\"title\": \"Zitadel improperly sanitizes HTML in emails and Console UI\", \"source\": {\"advisory\": \"GHSA-v333-7h2p-5fhv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"zitadel\", \"product\": \"zitadel\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.52.0, \u003c 2.52.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.53.0, \u003c 2.53.9\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.54.0, \u003c 2.54.8\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.55.0, \u003c 2.55.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.56.0, \u003c 2.56.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.57.0, \u003c 2.57.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.58.0, \u003c 2.58.1\"}]}], \"references\": [{\"url\": \"https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv\", \"name\": \"https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747\", \"name\": \"https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b\", \"name\": \"https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f\", \"name\": \"https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7\", \"name\": \"https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2\", \"name\": \"https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923\", \"name\": \"https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615\", \"name\": \"https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/releases/tag/v2.52.3\", \"name\": \"https://github.com/zitadel/zitadel/releases/tag/v2.52.3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/releases/tag/v2.53.9\", \"name\": \"https://github.com/zitadel/zitadel/releases/tag/v2.53.9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/releases/tag/v2.54.8\", \"name\": \"https://github.com/zitadel/zitadel/releases/tag/v2.54.8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/releases/tag/v2.55.5\", \"name\": \"https://github.com/zitadel/zitadel/releases/tag/v2.55.5\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/releases/tag/v2.56.2\", \"name\": \"https://github.com/zitadel/zitadel/releases/tag/v2.56.2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/releases/tag/v2.57.1\", \"name\": \"https://github.com/zitadel/zitadel/releases/tag/v2.57.1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/zitadel/zitadel/releases/tag/v2.58.1\", \"name\": \"https://github.com/zitadel/zitadel/releases/tag/v2.58.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email. On the user\u0027s detail page, the username was also not sanitized and would also render HTML, giving an attacker the same vulnerability. While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8 2.53.9, and 2.52.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-31T16:42:33.125Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41953\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T13:48:32.705Z\", \"dateReserved\": \"2024-07-24T16:51:40.949Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-07-31T16:42:33.125Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-V333-7H2P-5FHV

Vulnerability from github – Published: 2024-07-31 20:59 – Updated: 2025-07-09 15:00

Summary

ZITADEL has improper HTML sanitization in emails and Console UI

Details

Impact

ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email.

During investigation of this issue a related issue was found and mitigated, where on the user's detail page the username was not sanitized and would also render HTML, giving an attacker the same vulnerability.

While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI.

Patches

2.x versions are fixed on >= 2.58.1 2.57.x versions are fixed on >= 2.57.1 2.56.x versions are fixed on >= 2.56.2 2.55.x versions are fixed on >= 2.55.5 2.54.x versions are fixed on >= 2.54.8 2.53.x versions are fixed on >= 2.53.9 2.52.x versions are fixed on >= 2.52.9

Workarounds

There is no workaround since a patch is already available.

Questions

If you have any questions or comments about this advisory, please email us at security@zitadel.com

Credits

Thanks to Sushmita Poudel and David Underwood for reporting this.

Severity ?

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.80.1"
            },
            {
              "fixed": "2.52.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.53.0"
            },
            {
              "fixed": "2.53.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.54.0"
            },
            {
              "fixed": "2.54.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.55.0"
            },
            {
              "fixed": "2.55.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.56.0"
            },
            {
              "fixed": "2.56.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.57.0"
            },
            {
              "fixed": "2.57.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.57.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.58.0"
            },
            {
              "fixed": "2.58.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.58.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20240731122110-189505c80fa6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0"
            },
            {
              "fixed": "1.80.0-v2.20.0.20240731122110-189505c80fa6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-41953"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-31T20:59:13Z",
    "nvd_published_at": "2024-07-31T17:15:10Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code.\nThis may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email.\n\nDuring investigation of this issue a related issue was found and mitigated, where on the user\u0027s detail page the username was not sanitized and would also render HTML, giving an attacker the same vulnerability.\n\nWhile it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.58.1](https://github.com/zitadel/zitadel/releases/tag/v2.58.1)\n2.57.x versions are fixed on \u003e= [2.57.1](https://github.com/zitadel/zitadel/releases/tag/v2.57.1)\n2.56.x versions are fixed on \u003e= [2.56.2](https://github.com/zitadel/zitadel/releases/tag/v2.56.2)\n2.55.x versions are fixed on \u003e= [2.55.5](https://github.com/zitadel/zitadel/releases/tag/v2.55.5)\n2.54.x versions are fixed on \u003e= [2.54.8](https://github.com/zitadel/zitadel/releases/tag/v2.54.8)\n2.53.x versions are fixed on \u003e= [2.53.9](https://github.com/zitadel/zitadel/releases/tag/v2.53.9)\n2.52.x versions are fixed on \u003e= [2.52.9](https://github.com/zitadel/zitadel/releases/tag/v2.52.3)\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Sushmita Poudel and David Underwood for reporting this.",
  "id": "GHSA-v333-7h2p-5fhv",
  "modified": "2025-07-09T15:00:31Z",
  "published": "2024-07-31T20:59:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41953"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-3015"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.58.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.57.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.56.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.55.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.54.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.53.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.52.3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zitadel/zitadel"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ZITADEL has improper HTML sanitization in emails and Console UI"
}

FKIE_CVE-2024-41953

Vulnerability from fkie_nvd - Published: 2024-07-31 17:15 - Updated: 2025-01-08 18:29

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747	Patch
security-advisories@github.com	https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b	Patch
security-advisories@github.com	https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f	Patch
security-advisories@github.com	https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7	Patch
security-advisories@github.com	https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2	Patch
security-advisories@github.com	https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923	Patch
security-advisories@github.com	https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615	Patch
security-advisories@github.com	https://github.com/zitadel/zitadel/releases/tag/v2.52.3	Release Notes
security-advisories@github.com	https://github.com/zitadel/zitadel/releases/tag/v2.53.9	Release Notes
security-advisories@github.com	https://github.com/zitadel/zitadel/releases/tag/v2.54.8	Release Notes
security-advisories@github.com	https://github.com/zitadel/zitadel/releases/tag/v2.55.5	Release Notes
security-advisories@github.com	https://github.com/zitadel/zitadel/releases/tag/v2.56.2	Release Notes
security-advisories@github.com	https://github.com/zitadel/zitadel/releases/tag/v2.57.1	Release Notes
security-advisories@github.com	https://github.com/zitadel/zitadel/releases/tag/v2.58.1	Release Notes
security-advisories@github.com	https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv	Vendor Advisory

Impacted products

Vendor	Product	Version
zitadel	zitadel	*
zitadel	zitadel	*
zitadel	zitadel	*
zitadel	zitadel	*
zitadel	zitadel	*
zitadel	zitadel	2.57.0
zitadel	zitadel	2.57.0
zitadel	zitadel	2.57.0
zitadel	zitadel	2.58.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5175425-BCED-488C-8786-E093C1D5E561",
              "versionEndExcluding": "2.52.3",
              "versionStartIncluding": "2.52.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FEB64E1-AA7A-44A6-97EA-D82646DA5D07",
              "versionEndExcluding": "2.53.9",
              "versionStartIncluding": "2.53.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F42BFC4E-33C3-48F0-9CAB-72D2EEFEF163",
              "versionEndExcluding": "2.54.8",
              "versionStartIncluding": "2.54.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C81EA150-B7C8-4682-9D33-B04DB4075205",
              "versionEndExcluding": "2.55.5",
              "versionStartIncluding": "2.55.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7675309A-22D1-4A64-9CB6-F36A496C421F",
              "versionEndExcluding": "2.56.2",
              "versionStartIncluding": "2.56.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:2.57.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "CAA9A765-F2B2-46B8-BEA8-F9CEA81BEFA3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:2.57.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "4863B756-9DE4-4171-8035-E6965D55D578",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:2.57.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C2FEB539-0344-44F4-9595-9C35033FBF14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:2.58.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "02DB4060-6B1F-4FDB-9B50-6C47B613B8B1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email. On the user\u0027s detail page, the username was also not sanitized and would also render HTML, giving an attacker the same vulnerability. While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8 2.53.9, and 2.52.3."
    },
    {
      "lang": "es",
      "value": "Zitadel es un sistema de gesti\u00f3n de identidades de c\u00f3digo abierto. ZITADEL utiliza HTML para los correos electr\u00f3nicos y muestra cierta informaci\u00f3n, como los nombres de usuario, de forma din\u00e1mica. Esa informaci\u00f3n puede ser ingresada por usuarios o administradores. Debido a la falta de sanitizaci\u00f3n de la salida, estos correos electr\u00f3nicos podr\u00edan incluir c\u00f3digo malicioso. Esto puede generar potencialmente una amenaza en la que un atacante, sin privilegios, podr\u00eda enviar notificaciones alteradas que forman parte de los procesos de registro. Un atacante podr\u00eda crear un enlace malicioso, donde el c\u00f3digo inyectado se presentar\u00eda como parte del correo electr\u00f3nico. En la p\u00e1gina de detalles del usuario, el nombre de usuario tampoco estaba sanitizado y tambi\u00e9n representaba HTML, lo que le daba al atacante la misma vulnerabilidad. Si bien era posible inyectar HTML, incluido JavaScript, la mayor\u00eda de los clientes de correo electr\u00f3nico y la Pol\u00edtica de seguridad de contenido en la interfaz de usuario de la consola impedir\u00edan la ejecuci\u00f3n de dichos scripts. Esta vulnerabilidad se solucion\u00f3 en 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8 2.53.9 y 2.52.3."
    }
  ],
  "id": "CVE-2024-41953",
  "lastModified": "2025-01-08T18:29:25.370",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-07-31T17:15:10.850",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.52.3"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.53.9"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.54.8"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.55.5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.56.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.57.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.58.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-41953 (GCVE-0-2024-41953)

GHSA-V333-7H2P-5FHV

Impact

Patches

Workarounds

Questions

Credits

FKIE_CVE-2024-41953

Tags

Sightings

Nomenclature