VulnerabilityModified

CVE-2024-42325

Zabbix API user.get returns all users that share common group with the calling user.

LOW 2.1EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.

CVSS 4.0: 2.1 LOWCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-359
Affected: zabbix/zabbix
Source: security@zabbix.com

References

https://support.zabbix.com/browse/ZBX-26258Vendor Advisory
https://lists.debian.org/debian-lts-announce/2025/04/msg00027.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.