{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2024-28855",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2024-28855",
    "idYear": 2024,
    "status": "PUBLISHED",
    "publishedAt": "2024-03-18T21:46:47.314Z",
    "updatedAt": "2024-08-13T14:19:08.789Z",
    "importedAt": "2026-10-24T01:57:11.582Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "ZITADEL vulnerable to improper HTML sanitization",
      "summary": "ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including JavaScript, the execution of such scripts would be prevented by the Content Security Policy. Versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15 contain a patch for this issue. No known workarounds are available.",
      "affected": [
        {
          "vendor": "zitadel",
          "product": "zitadel",
          "versions": [
            {
              "version": "< 2.41.15",
              "status": "affected"
            },
            {
              "version": ">= 2.42.0, < 2.42.15",
              "status": "affected"
            },
            {
              "version": ">= 2.43.0, < 2.43.9",
              "status": "affected"
            },
            {
              "version": ">= 2.44.0, < 2.44.3",
              "status": "affected"
            },
            {
              "version": "= 2.45.0",
              "status": "affected"
            },
            {
              "version": "= 2.46.0",
              "status": "affected"
            },
            {
              "version": ">= 2.47.0, < 2.47.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}