CVE-2024-42325

Excessive information returned by user.get

CVSS 2.1 LOWEPSS 0.3%CWE-359

Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.

CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

Zabbix · Zabbix

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://lists.debian.org/debian-lts-announce/2025/04/msg00027.html https://support.zabbix.com/browse/ZBX-26258