ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0.
References
| Link | Resource |
|---|---|
| https://github.com/zitadel/zitadel/releases/tag/v2.50.0 | Release Notes |
| https://github.com/zitadel/zitadel/releases/tag/v2.50.0 | Release Notes |
| https://github.com/zitadel/zitadel/security/advisories/GHSA-7j7j-66cv-m239 | Vendor Advisory |
| https://github.com/zitadel/zitadel/security/advisories/GHSA-7j7j-66cv-m239 | Vendor Advisory |
Configurations
History
08 Jan 2025, 18:21
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| CWE | CWE-307 | |
| References | () https://github.com/zitadel/zitadel/releases/tag/v2.50.0 - Release Notes | |
| References | () https://github.com/zitadel/zitadel/security/advisories/GHSA-7j7j-66cv-m239 - Vendor Advisory | |
| CPE | cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* | |
| First Time |
Zitadel zitadel
Zitadel |
26 Apr 2024, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-26 00:15
Updated : 2025-01-08 18:21
NVD link : CVE-2024-32868
Mitre link : CVE-2024-32868
JSON object : View
Products Affected
zitadel
- zitadel
CWE
CWE-307
Improper Restriction of Excessive Authentication Attempts