CVEvulnerability

CVE-2024-29892

4.9 MEDIUM Published 2024-03-27 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-03-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-863

Description

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.

Affected configurations

• zitadel zitadel (< 2.42.17) • zitadel zitadel (>= 2.43.0 < 2.43.11) • zitadel zitadel (>= 2.44.0 < 2.44.7) • zitadel zitadel (>= 2.45.0 < 2.45.5) • zitadel zitadel (>= 2.46.0 < 2.46.5) • zitadel zitadel (>= 2.47.0 < 2.47.8) • zitadel zitadel (>= 2.48.0 < 2.48.3)

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References