Detections
Analytics
CVE-2024-41953
medium
Description
Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email. On the user's detail page, the username was also not sanitized and would also render HTML, giving an attacker the same vulnerability. While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8 2.53.9, and 2.52.3.
References
https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv
https://github.com/zitadel/zitadel/releases/tag/v2.58.1
https://github.com/zitadel/zitadel/releases/tag/v2.57.1
https://github.com/zitadel/zitadel/releases/tag/v2.56.2
https://github.com/zitadel/zitadel/releases/tag/v2.55.5
https://github.com/zitadel/zitadel/releases/tag/v2.54.8
https://github.com/zitadel/zitadel/releases/tag/v2.53.9
https://github.com/zitadel/zitadel/releases/tag/v2.52.3
https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615
https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923
https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2
https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7
https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f
https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b
https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747