CVE-2024-49757

Katalog CVE

CVSS 4.9 · Medium EPSS 2,5%

Kerentanan Improper Authentication pada zitadel. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.

Rincian

Terbit di NVD

25 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zitadel/zitadel/security/advisories/GHSA-3rmw-76m6-4gjc patch · advisory vendor
• https://github.com/zitadel/zitadel/releases/tag/v2.58.7 release notes
• https://github.com/zitadel/zitadel/releases/tag/v2.59.5 release notes
• https://github.com/zitadel/zitadel/releases/tag/v2.60.4 release notes
• https://github.com/zitadel/zitadel/releases/tag/v2.61.4 release notes
• https://github.com/zitadel/zitadel/releases/tag/v2.62.7 release notes
• https://github.com/zitadel/zitadel/releases/tag/v2.63.5 release notes
• https://github.com/zitadel/zitadel/releases/tag/v2.64.0 release notes