{"cve":"CVE-2024-28855","nvd":{"published":"2024-03-18T22:15:08.963","modified":"2026-06-17T07:21:53.947","status":"Analyzed","description":"ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including JavaScript, the execution of such scripts would be prevented by the Content Security Policy. Versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15 contain a patch for this issue. No known workarounds are available.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79","CWE-20"],"references":["https://github.com/zitadel/zitadel/releases/tag/v2.41.15","https://github.com/zitadel/zitadel/releases/tag/v2.42.15","https://github.com/zitadel/zitadel/releases/tag/v2.43.9","https://github.com/zitadel/zitadel/releases/tag/v2.44.3","https://github.com/zitadel/zitadel/releases/tag/v2.45.1"],"products":["zitadel:zitadel"],"source":"nvd","synced_at":"2026-10-19T21:46:54.846886191+00:00"},"epss":{"cve":"CVE-2024-28855","score":0.00779,"percentile":0.55902,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hfrg-4jwr-jfpj","url":"https://osv.dev/vulnerability/GHSA-hfrg-4jwr-jfpj","summary":"Improper HTML sanitization in ZITADEL","modified":"2026-09-10T03:50:10.567094211Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=1.80.1 <2.41.15"],"fixed":["2.41.15"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.42.0 <2.42.15"],"fixed":["2.42.15"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.43.0 <2.43.9"],"fixed":["2.43.9"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.44.0 <2.44.3"],"fixed":["2.44.3"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.45.0 <2.45.1"],"fixed":["2.45.1"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.46.0 <2.46.1"],"fixed":["2.46.1"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.47.0 <2.47.4"],"fixed":["2.47.4"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["<0.0.0-20240311065202-07ec2efa9dc6"],"fixed":["0.0.0-20240311065202-07ec2efa9dc6"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=0.0.0 <1.80.0-v2.20.0.20240311065202-07ec2efa9dc6"],"fixed":["1.80.0-v2.20.0.20240311065202-07ec2efa9dc6"]}]},{"id":"GO-2024-2655","url":"https://osv.dev/vulnerability/GO-2024-2655","summary":"XSS in github.com/zitadel/zitadel","modified":"2024-07-09T19:33:56Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["<1.80.0-v2.20.0.20240312162750-5908b97e7c22"],"fixed":["1.80.0-v2.20.0.20240312162750-5908b97e7c22"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}