CVE-2024-32967
published 2024-05-01CVE-2024-32967: Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.64%
45.8th percentile
Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | zitadel_zitadel | >= 0 < 2.45.7 | 2.45.7 |
| github.com | zitadel_zitadel | >= 2.47.0 < 2.47.10 | 2.47.10 |
| github.com | zitadel_zitadel | >= 2.48.0 < 2.48.5 | 2.48.5 |
| github.com | zitadel_zitadel | >= 2.49.0 < 2.49.5 | 2.49.5 |
| github.com | zitadel_zitadel | >= 2.50.0 < 2.50.3 | 2.50.3 |
| zitadel | zitadel | < 2.45.7 | 2.45.7 |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | >= 2.46.0 < 2.46.7 | 2.46.7 |
| zitadel | zitadel | >= 2.47.0 < 2.47.10 | 2.47.10 |
| zitadel | zitadel | >= 2.48.0 < 2.48.5 | 2.48.5 |
| zitadel | zitadel | >= 2.49.0 < 2.49.5 | 2.49.5 |
| zitadel | zitadel | >= 2.50.0 < 2.50.3 | 2.50.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel
osv·2024-06-05
CVE-2024-32967 Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel
Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel
Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/zitadel/zitadel before v2.45.7, from v2.47.0 before v2.47.10, from v2.48.0 before v2.48.5, from v2.49.0 before v2.49.5, from v2.50.0 before v2.50.3.
OSV
Zitadel exposing internal database user name and host information
osv·2024-05-01
CVE-2024-32967 [MEDIUM] Zitadel exposing internal database user name and host information
Zitadel exposing internal database user name and host information
### Impact
In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user.
### Patches
2.x versions are fixed on >= [2.50.3](https://github.com/zitadel/zitadel/releases/tag/v2.50.3)
2.49.x versions are fixed on >= [2.49.5](https://github.com/zitadel/zitadel/releases/tag/v2.49.5)
2.48.x versions are fixed on >= [2.48.5](https://github.com/zitadel/zitadel/releases/tag/v2.48.5)
2.47.x versions are fixed on >= [2.47.10](https://github.com/zitadel/zitadel/releases/tag/v2.47.10)
2.46.x versions are fixed on >= [2.46.7](https://github.com/zitadel/zitadel/releases/tag/v2.46.7)
2.45.x versions are fixed on >= [2.45.7](https://github.com/zitadel/
GHSA
Zitadel exposing internal database user name and host information
ghsa·2024-05-01
CVE-2024-32967 [MEDIUM] CWE-200 Zitadel exposing internal database user name and host information
Zitadel exposing internal database user name and host information
### Impact
In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user.
### Patches
2.x versions are fixed on >= [2.50.3](https://github.com/zitadel/zitadel/releases/tag/v2.50.3)
2.49.x versions are fixed on >= [2.49.5](https://github.com/zitadel/zitadel/releases/tag/v2.49.5)
2.48.x versions are fixed on >= [2.48.5](https://github.com/zitadel/zitadel/releases/tag/v2.48.5)
2.47.x versions are fixed on >= [2.47.10](https://github.com/zitadel/zitadel/releases/tag/v2.47.10)
2.46.x versions are fixed on >= [2.46.7](https://github.com/zitadel/zitadel/releases/tag/v2.46.7)
2.45.x versions are fixed on >= [2.45.7](https://github.com/zitadel/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/zitadel/zitadel/commit/b918603b576d156a08b90917c14c2d019c82ffc6https://github.com/zitadel/zitadel/releases/tag/v2.45.7https://github.com/zitadel/zitadel/releases/tag/v2.46.7https://github.com/zitadel/zitadel/releases/tag/v2.47.10https://github.com/zitadel/zitadel/releases/tag/v2.48.5https://github.com/zitadel/zitadel/releases/tag/v2.49.5https://github.com/zitadel/zitadel/releases/tag/v2.50.3https://github.com/zitadel/zitadel/security/advisories/GHSA-q5qj-x2h5-3945https://github.com/zitadel/zitadel/commit/b918603b576d156a08b90917c14c2d019c82ffc6https://github.com/zitadel/zitadel/releases/tag/v2.45.7https://github.com/zitadel/zitadel/releases/tag/v2.46.7https://github.com/zitadel/zitadel/releases/tag/v2.47.10https://github.com/zitadel/zitadel/releases/tag/v2.48.5https://github.com/zitadel/zitadel/releases/tag/v2.49.5https://github.com/zitadel/zitadel/releases/tag/v2.50.3https://github.com/zitadel/zitadel/security/advisories/GHSA-q5qj-x2h5-3945
2024-05-01
Published