CVE-2024-32967: Zitadel exposes internal database user name and host information
Impact
In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user.
Patches
2.x versions are fixed on >= 2.50.3 2.49.x versions are fixed on >= 2.49.5 2.48.x versions are fixed on >= 2.48.5 2.47.x versions are fixed on >= 2.47.10 2.46.x versions are fixed on >= 2.46.7 2.45.x versions are fixed on >= 2.45.7
Workarounds
There is no workaround since a patch is already available.
Questions
If you have any questions or comments about this advisory, please email us at security@zitadel.com
Other sources
Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32967?
CVE-2024-32967 has a high severity due to the potential exposure of sensitive database connection details to users.
How do I fix CVE-2024-32967?
To fix CVE-2024-32967, upgrade to Zitadel version 2.50.3 or later.
Which versions of Zitadel are affected by CVE-2024-32967?
Affected versions of Zitadel include those below 2.50.3, specifically versions up to 2.45.7 and versions from 2.46.0 to 2.49.5.
What information is exposed in CVE-2024-32967?
CVE-2024-32967 can expose database connection information such as the database name, username, and host name.
Is there a patch available for CVE-2024-32967?
Yes, the vulnerability has been patched in Zitadel version 2.50.3 and later.