x/vulndb: potential Go vuln in github.com/zitadel/zitadel: CVE-2024-39683

Advisory CVE-2024-39683 references a vulnerability in the following Go modules:

Module
github.com/zitadel/zitadel

Description: ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions. Versions 2.55.1, 2.54.5, and 2.53.8 contain a fix for the issue. There is no workaround since a patch is already available.

References:

Cross references:

Module github.com/zitadel/zitadel appears in issue #961 NOT_IMPORTABLE
Module github.com/zitadel/zitadel appears in issue #1489 NOT_IMPORTABLE
Module github.com/zitadel/zitadel appears in issue #2107 EFFECTIVELY_PRIVATE
Module github.com/zitadel/zitadel appears in issue #2155 EFFECTIVELY_PRIVATE
Module github.com/zitadel/zitadel appears in issue #2187 EFFECTIVELY_PRIVATE
Module github.com/zitadel/zitadel appears in issue #2368 NOT_IMPORTABLE
Module github.com/zitadel/zitadel appears in issue #2637
Module github.com/zitadel/zitadel appears in issue #2655
Module github.com/zitadel/zitadel appears in issue #2664
Module github.com/zitadel/zitadel appears in issue #2665
Module github.com/zitadel/zitadel appears in issue #2788
Module github.com/zitadel/zitadel appears in issue #2804

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/zitadel/zitadel
      vulnerable_at: 1.87.5
summary: CVE-2024-39683 in github.com/zitadel/zitadel
cves:
    - CVE-2024-39683
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39683
    - fix: https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04
    - fix: https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3da
    - fix: https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73
    - fix: https://github.com/zitadel/zitadel/pull/8231
    - report: https://github.com/zitadel/zitadel/issues/8213
    - web: https://discord.com/channels/927474939156643850/1254096852937347153
    - web: https://github.com/zitadel/zitadel/releases/tag/v2.53.8
    - web: https://github.com/zitadel/zitadel/releases/tag/v2.54.5
    - web: https://github.com/zitadel/zitadel/releases/tag/v2.55.1
    - web: https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397
source:
    id: CVE-2024-39683
    created: 2024-07-03T21:01:26.257589348Z
review_status: UNREVIEWED

golang / vulndb

x/vulndb: potential Go vuln in github.com/zitadel/zitadel: CVE-2024-39683 #2968