U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2024-41953 Detail

Description

Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email. On the user's detail page, the username was also not sanitized and would also render HTML, giving an attacker the same vulnerability. While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI. This vulnerability is fixed in 2.58.1, 2.57.1, 2.56.2, 2.55.5, 2.54.8 2.53.9, and 2.52.3.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://github.com/zitadel/zitadel/commit/0e1f99e987b5851caec45a72660fe9f67e425747 GitHub, Inc. Patch 
https://github.com/zitadel/zitadel/commit/38da602ee1cfc35c0d7918c298fbfc3f3674133b GitHub, Inc. Patch 
https://github.com/zitadel/zitadel/commit/4b59cac67bb89c1f3f84a2041dd273d11151d29f GitHub, Inc. Patch 
https://github.com/zitadel/zitadel/commit/c1a3fc72dde16e987d8a09aa291e7c2edfc928f7 GitHub, Inc. Patch 
https://github.com/zitadel/zitadel/commit/c353f82f89c6982c0888c6763363296cf4263cb2 GitHub, Inc. Patch 
https://github.com/zitadel/zitadel/commit/d04ac6df8f2f0243e649b802a8bfa6176cef0923 GitHub, Inc. Patch 
https://github.com/zitadel/zitadel/commit/f846616a3f022e88e3ea8cea05d3254ad86f1615 GitHub, Inc. Patch 
https://github.com/zitadel/zitadel/releases/tag/v2.52.3 GitHub, Inc. Release Notes 
https://github.com/zitadel/zitadel/releases/tag/v2.53.9 GitHub, Inc. Release Notes 
https://github.com/zitadel/zitadel/releases/tag/v2.54.8 GitHub, Inc. Release Notes 
https://github.com/zitadel/zitadel/releases/tag/v2.55.5 GitHub, Inc. Release Notes 
https://github.com/zitadel/zitadel/releases/tag/v2.56.2 GitHub, Inc. Release Notes 
https://github.com/zitadel/zitadel/releases/tag/v2.57.1 GitHub, Inc. Release Notes 
https://github.com/zitadel/zitadel/releases/tag/v2.58.1 GitHub, Inc. Release Notes 
https://github.com/zitadel/zitadel/security/advisories/GHSA-v333-7h2p-5fhv GitHub, Inc. Vendor Advisory 

Weakness Enumeration

CWE-ID CWE Name Source
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') cwe source acceptance level NIST   GitHub, Inc.  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2024-41953
NVD Published Date:
07/31/2024
NVD Last Modified:
01/08/2025
Source:
GitHub, Inc.