UpHeron
All vulnerabilities

Servers and applications

CVE-2024-28855

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be…

Severity
Medium 6.1
Published
18 Mar 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.41.15, 2.42.15, 2.43.9, 2.44.3, 2.47.4
Sources
NVD

Affected software

SoftwareAffected versions
ZITADELServers and applications · cpe:a:zitadel:zitadel
  • From 2.47.0 before 2.47.4
  • Version 2.46.0
  • Version 2.46.0-rc2
  • Version 2.46.0-rc1
All 10 release lines
  • Every version before 2.41.15
  • From 2.42.0 before 2.42.15
  • From 2.43.0 before 2.43.9
  • From 2.44.0 before 2.44.3
  • Version 2.45.0-rc1
  • Version 2.45.0
  • Version 2.46.0-rc1
  • Version 2.46.0-rc2
  • Version 2.46.0
  • From 2.47.0 before 2.47.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-28855
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-28855