NetSight
IP …
medium5.3

CVE-2024-32967

Zitadel exposing internal database user name and host information

Impact

### Impact In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. ### Patches 2.x versions are fixed on >= [2.50.3](https://github.com/zitadel/zitadel/releases/tag/v2.50.3) 2.49.x versions are fixed on >= [2.49.5](https://github.com/zitadel/zitadel/releases/tag/v2.49.5) 2.48.x versions are fixed on >= [2.48.5](https://github.com/zitadel/zitadel/releases/tag/v2.48.5) 2.47.x versions are fixed on >= [2.47.10](https://github.com/zitadel/zitadel/releases/tag/v2.47.10) 2.46.x versions are fixed on >= [2.46.7](https://github.com/zitadel/zitadel/releases/tag/v2.46.7) 2.45.x versions are fixed on >= [2.45.7](https://github.com/zitadel/zitadel/releases/tag/v2.45.7) ### Workarounds There is no workaround since a patch is already available. ### Questions If you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)

Affected packages

EcosystemPackageAffectedFixed in
gogithub.com/zitadel/zitadel>= 2.50.0, < 2.50.32.50.3

Affected products

VendorProductAffected versions
ZitadelZitadel
before 2.45.7
from 2.46.0 before 2.46.7
from 2.47.0 before 2.47.10
from 2.48.0 before 2.48.5
from 2.49.0 before 2.49.5
from 2.50.0 before 2.50.3

Weakness classification

CWE-200

References