Vulnerability Description
ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions. Versions 2.55.1, 2.54.5, and 2.53.8 contain a fix for the issue. There is no workaround since a patch is already available.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zitadel | Zitadel | >= 2.53.0, < 2.53.8 |
Related Weaknesses (CWE)
References
- https://discord.com/channels/927474939156643850/1254096852937347153Permissions RequiredURL Repurposed
- https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649fPatch
- https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3Patch
- https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790dPatch
- https://github.com/zitadel/zitadel/issues/8213Issue TrackingRelease Notes
- https://github.com/zitadel/zitadel/pull/8231Issue Tracking
- https://github.com/zitadel/zitadel/releases/tag/v2.53.8Release Notes
- https://github.com/zitadel/zitadel/releases/tag/v2.54.5Release Notes
- https://github.com/zitadel/zitadel/releases/tag/v2.55.1Release Notes
- https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397Vendor Advisory
- https://discord.com/channels/927474939156643850/1254096852937347153Permissions RequiredURL Repurposed
- https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649fPatch
- https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3Patch
- https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790dPatch
- https://github.com/zitadel/zitadel/issues/8213Issue TrackingRelease Notes
FAQ
What is CVE-2024-39683?
CVE-2024-39683 is a vulnerability with a CVSS score of 5.7 (MEDIUM). ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Starting in version 2.53.0 and prior to versio...
How severe is CVE-2024-39683?
CVE-2024-39683 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-39683?
Check the references section above for vendor advisories and patch information. Affected products include: Zitadel Zitadel.