Improper Input Validation Affecting github.com/zitadel/zitadel/cmd/start package, versions <2.58.7 >=2.59.0 <2.59.5 >=2.60.0 <2.60.4 >=2.61.0 <2.61.4 >=2.62.0 <2.62.8 >=2.63.0 <2.63.6 >=2.64.0 <2.64.1
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (15th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMZITADELZITADELCMDSTART-8309539
- published 29 Oct 2024
- disclosed 25 Oct 2024
- credit Pradip Bhattarai
Introduced: 25 Oct 2024
New CVE-2024-49753 Open this link in a new tabHow to fix?
Upgrade github.com/zitadel/zitadel/cmd/start to version 2.58.7, 2.59.5, 2.60.4, 2.61.4, 2.62.8, 2.63.6, 2.64.1 or higher.
Overview
Affected versions of this package are vulnerable to Improper Input Validation via the URL validation mechanism. An attacker can bypass restrictions intended to block requests to localhost by creating a DNS record that resolves to 127.0.0.1.