Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
vulnrichmentGitHub_MVULNRICHMENT:CVE-2024-32967
HistoryMay 01, 2024 - 6:43 a.m.

CVE-2024-32967 Zitadel exposes internal database user name and host information

2024-05-0106:43:36
CWE-200
GitHub_M
github.com
1
zitadel
vulnerability
database security

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0

Percentile

13.0%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*"
    ],
    "vendor": "zitadel",
    "product": "zitadel",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.45.7",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.46.0",
        "lessThan": "2.46.7",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.47.0",
        "lessThan": "2.47.10",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.48.0",
        "lessThan": "2.48.5",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.49.0",
        "lessThan": "2.49.5",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.50.0",
        "lessThan": "2.50.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Related

nvd 1
cvelist 1
osv 3
veracode 1
cve 1
github 1
nvd
nvd
CVE-2024-32967
2024-05-01 07:15:40
cvelist
cvelist
CVE-2024-32967 Zitadel exposes internal database user name and host information
2024-05-01 06:43:36
osv
osv
Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel
2024-06-05 15:10:42
CVE-2024-32967
2024-05-01 07:15:40
Zitadel exposing internal database user name and host information
2024-05-01 16:36:04
veracode
veracode
Information Disclosure
2024-05-12 06:05:04
cve
cve
CVE-2024-32967
2024-05-01 07:15:40
github
github
Zitadel exposing internal database user name and host information
2024-05-01 16:36:04

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0

Percentile

13.0%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON
Related for VULNRICHMENT:CVE-2024-32967
nvd1cvelist1osv3veracode1cve1github1