GHSA-v683-rcxx-vpff

Source

https://github.com/advisories/GHSA-v683-rcxx-vpff

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v683-rcxx-vpff/GHSA-v683-rcxx-vpff.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-v683-rcxx-vpff

Aliases

CVE-2023-44399

Related

CVE-2023-44399

Published

2023-10-10T21:30:15Z

Modified

2023-11-01T05:03:02.506588Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting

Details

Impact

ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL.

Patches

This bug has been patched in versions >2.27.2 beginning with 2.37.3 and 2.38.0

Workarounds

None available we advise to updated if this is needed.

References

None

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2023-10-10T17:15:13Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-640"
    ],
    "github_reviewed_at": "2023-10-10T21:30:15Z"
}

References

Affected packages

Go / github.com/zitadel/zitadel

Package

Name: github.com/zitadel/zitadel; View open source insights on deps.dev
Purl: pkg:golang/github.com/zitadel/zitadel

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.37.3