| id: GO-2024-2655 |
| modules: |
| - module: github.com/zitadel/zitadel |
| versions: |
| - fixed: 1.80.0-v2.20.0.20240312162750-5908b97e7c22 |
| non_go_versions: |
| - fixed: 2.41.15 |
| - introduced: 2.42.0 |
| - fixed: 2.42.15 |
| - introduced: 2.43.0 |
| - fixed: 2.43.9 |
| - introduced: 2.44.0 |
| - fixed: 2.44.3 |
| - introduced: 2.45.0 |
| - fixed: 2.45.1 |
| - introduced: 2.46.0 |
| - fixed: 2.46.1 |
| - introduced: 2.47.0 |
| - fixed: 2.47.4 |
| vulnerable_at: 1.80.0-v2.20 |
| packages: |
| - package: github.com/zitadel/zitadel/internal/renderer |
| skip_fix: Uses replacement directives. |
| summary: XSS in github.com/zitadel/zitadel |
| description: |- |
| The Login UI did not sanitize input parameters. An attacker could create a |
| malicious link, where injected code would be rendered as part of the login |
| screen. |
| cves: |
| - CVE-2024-28855 |
| ghsas: |
| - GHSA-hfrg-4jwr-jfpj |
| credits: |
| - Daniel Philipp (OWT) and Thomas Wickham (Synopsis) |
| references: |
| - advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-hfrg-4jwr-jfpj |
| - fix: https://github.com/zitadel/zitadel/commit/07ec2efa9dc62f7a6c3a58c112b2879d24bc3e3c |
| notes: |
| - 1.80.0-v2.20.0.20240312162750-5908b97e7c22 corresponds to 2.47.4. We are using this as a timestamp. |
| review_status: REVIEWED |
