Zitadel 2.46.0
Approved changes feed: RSS · Atom
cpe:2.3:a:zitadel:zitadel:2.46.0:-:*:*:*:*:*:*part: a version: 2.46.0 update: -
| Vendor | Zitadel (1429bbd3-ff0b-5a63-9318-6d24fa466907) |
|---|---|
| Product | Zitadel (5b7e6d03-41a8-5ef5-a05a-9a37394fa532) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/jquepi/zitadel |
purl2cpe | 2026-06-01 10:16:13.445008 |
pkg:github/zitadel/zitadel |
purl2cpe | 2026-06-01 10:16:13.445009 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-28855 |
vulnerable | 2026-06-08 06:33:27.740570 |
ZITADEL vulnerable to improper HTML sanitization
HIGH (8.1)
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including JavaScript, the execution of such scripts would be prevented by the Content Security Policy. Versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15 contain a patch for this issue. No known workarounds are available.
Published: 2024-03-18T21:46:47.314Z
Updated: 2024-08-13T14:19:08.789Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.