CVE-2024-28855
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
ZITADEL vulnerable to improper HTML sanitization
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including JavaScript, the execution of such scripts would be prevented by the Content Security Policy. Versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15 contain a patch for this issue. No known workarounds are available.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
zitadel
- Vendor
- zitadel
- Product
- zitadel
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| < 2.41.15 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 2.42.0, < 2.42.15 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 2.43.0, < 2.43.9 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 2.44.0, < 2.44.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| = 2.45.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| = 2.46.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 2.47.0, < 2.47.4 | affected | Unavailable | Unavailable | Unavailable | None listed |