Vulnerability Report: GO-2024-2655
- CVE-2024-28855, GHSA-hfrg-4jwr-jfpj
- Affects: github.com/zitadel/zitadel
- Published: Mar 27, 2024
- Modified: May 20, 2024
The Login UI did not sanitize input parameters. An attacker could create a malicious link, where injected code would be rendered as part of the login screen.
For detailed information about this vulnerability, visit https://github.com/zitadel/zitadel/security/advisories/GHSA-hfrg-4jwr-jfpj.
Affected Packages
-
PathVersionsSymbols
-
before v1.80.0-v2.20.0.20240312162750-5908b97e7c22all symbols
Aliases
References
- https://github.com/zitadel/zitadel/security/advisories/GHSA-hfrg-4jwr-jfpj
- https://github.com/zitadel/zitadel/commit/07ec2efa9dc62f7a6c3a58c112b2879d24bc3e3c
- https://vuln.go.dev/ID/GO-2024-2655.json
Credits
- Daniel Philipp (OWT) and Thomas Wickham (Synopsis)
Feedback
See anything missing or incorrect?
Suggest an edit to this report.