CVE-2023-46238

    Dashboard / Vulnerabilities / CVE-2023-46238

    CVE-2023-46238

    Published: 26 Oct 2023Last Modified: 28 Oct 2026

    Summary: XSS with User Avatar image in ZITADEL

    Details: ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to an SVG to gain access to the victim’s account in certain scenarios. A victim would need to directly open the malicious image in the browser, where a single session in ZITADEL needs to be active for this exploit to work. If the possible victim had multiple or no active sessions in ZITADEL, the attack would not succeed. This issue has been patched in version 2.39.2 and 2.38.2.

    References: https://github.com/zitadel/zitadel/releases/tag/v2.38.2, https://github.com/zitadel/zitadel/releases/tag/v2.39.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46238.json, https://github.com/zitadel/zitadel/security/advisories/GHSA-954h-jrpm-72pm, https://nvd.nist.gov/vuln/detail/CVE-2023-46238

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -78aa000d13ea2670cff16c01c23574f656f9a8f7

    Affected versions

    v2.38.1
    v2.38.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-46238 | CVE-DB