6.1

CVE-2024-41953: zitadel Cross-site Scripting

CVSS: 6.1v3.1MediumAnalyzed
AliasesGHSA-v333-7h2p-5fhvGO-2024-3015
Published 31-07-2024Last modified 01-08-2024
Open JSON

Vulnerability summary

CVE-2024-41953 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in zitadel. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.2% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (NVD)
EPSS score
0.65%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 31-07-2024
    PublishedVulnerability first disclosed.
  2. 01-08-2024
    Last modifiedVulnerability information updated.

Description

Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email. On the user's detail page, the username was also not sanitized and would also render HTML, giving an attacker the same vulnerability. While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8 2.53.9, and 2.52.3.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.65%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

0.00 pp

From 0.65% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.65%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Github.com/zitadel1 product
  • zitadel≥ 1.80.1, < 2.52.3 | ≥ 2.53.0, < 2.53.9 | ≥ 2.54.0, < 2.54.8 | ≥ 2.55.0, < 2.55.5 | ≥ 2.56.0, < 2.56.2 | ≥ 2.57.0, < 2.57.1 | ≥ 2.58.0, < 2.58.1 | < 0.0.0-20240731122110-189505c80fa6 | ≥ 0.0.0, < 1.80.0-v2.20.0.20240731122110-189505c80fa6 | All versions (No fix recorded)
Zitadel1 product
  • zitadel≥ 2.57.0, < 2.57.1 | ≥ 2.58.0, < 2.58.1 | ≥ 2.52.0, < 2.52.3 | ≥ 2.53.0, < 2.53.9 | ≥ 2.54.0, < 2.54.8 | ≥ 2.55.0, < 2.55.5 | ≥ 2.56.0, < 2.56.2 | 2.57.0 | 2.57.0:rc1 | 2.57.0:rc2 | 2.58.0

2 vendors · 2 products

References

18 links
Show all 18 references