CVE-2024-32967: 
NixOS vulnerability analysis and mitigation

CVE-2024-32967 affects Zitadel, an open source identity management system. The vulnerability was discovered when the system could not connect to the database, potentially exposing sensitive connection information including database name, username, and host name to unauthorized users. The issue was disclosed on May 1, 2024, and has been addressed in multiple release branches (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. It is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The issue affects multiple versions of Zitadel including versions prior to 2.45.7, 2.46.7, 2.47.10, 2.48.5, 2.49.5, and 2.50.3 (NVD).

When exploited, this vulnerability could lead to the disclosure of sensitive database connection details to unauthorized users, potentially providing attackers with valuable information about the internal infrastructure. This information exposure could be used as a stepping stone for further attacks (GitHub Advisory).

The vulnerability can be exploited remotely with low attack complexity and requires no privileges or user interaction. The attack vector is network-based, making it accessible to remote attackers when the system encounters database connection issues (NVD).

The vulnerability has been patched in multiple release versions: 2.45.7, 2.46.7, 2.47.10, 2.48.5, 2.49.5, and 2.50.3. There are no workarounds available, and users are strongly advised to upgrade to the latest patched version of their respective release branch (GitHub Advisory).

The vulnerability was responsibly reported by Shivam Tiwari, and the Zitadel team has provided patches across multiple release branches. The moderate severity rating and prompt patching demonstrate the vendor's commitment to security (GitHub Advisory).