This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Zabbix fixes 5 vulnerabilities
Zabbix fixes 5 vulnerabilities, two of which are high-severity. The fixes can be found in the links next to the individual vulnerabilities [1][2][3][4][5].
Allows an authenticated attacker in the local network with API access to execute arbitrary SQL commands through the groupBy parameter [1].
The vulnerability is present in product:
- *:Zabbix API; >=7.0.0, <=7.0.7; >=7.2.0, <=7.2.1
CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-36465 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 1. 4. 2025.
Allows an unauthenticated remote attacker, through the backurl parameter, to carry out an XSS attack due to insufficient handling of user input in the /zabbix.php?action=export.valuemaps endpoint [2].
The vulnerability is present in product:
- *Zabbix web interface; >=6.0.0, <=6.0.36; >=6.4.0,<=6.4.20; >=7.0.0, <=7.0.6
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-45699 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 1. 4. 2025.
Allows an unauthenticated attacker in the local network to send specially crafted requests to the server that cause excessive memory allocation and a computationally expensive decompression operation, leading to a service crash [3].
The vulnerability is present in products:
- *:Zabbix Server; >=6.0.0, <=6.0.38; >=7.0.0, <=7.0.9; >=7.2.0, <=7.2.3
- *:Zabbix Proxy; >=6.0.0, <=6.0.38; >=7.0.0, <=7.0.9; >=7.2.0, <=7.2.3
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-45700 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
- CWE-789: Memory Allocation with Excessive Size Value at cwe.mitre.org
The vulnerability was publicly disclosed 1. 4. 2025.
Allows an unauthenticated attacker in the local network to identify user accounts based on differing response times for failed logins [4].
The vulnerability is present in product:
- *:Zabbix web interface; >=5.0.0, <=5.0.45; >=6.0.0, <=6.0.37; >=7.0.0, <=7.0.8; >=7.2.0, <=7.2.2
CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2024-36469 at cve.org, NVD
- CWE-208: Observable Timing Discrepancy at cwe.mitre.org
The vulnerability was publicly disclosed 1. 4. 2025.
Allows an authenticated attacker in the local network to obtain information about all users who share the same group as the calling user, including media and other data such as login attempts [5].
The vulnerability is present in product:
- *:Zabbix API; >=5.0.0, <=5.0.45; >=6.0.0, <=6.0.37; >=7.0.0, <=7.0.8; >=7.2.0, <=7.2.2
CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2024-42325 at cve.org, NVD
- CWE-285: Improper Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 1. 4. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 3. 4. 2025.