CVE-2024-36469: User enumeration via timing attack in Zabbix web interface
Published Apr 2, 2025
·Updated
Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.
Affected Software
5 affected components
Zabbix Zabbix
Zabbix Zabbix>=5.0.0<5.0.46
Zabbix Zabbix>=6.0.0<6.0.38
Zabbix Zabbix>=7.0.0<7.0.9
Zabbix Zabbix>=7.2.0<7.2.3
Event History
Apr 2, 2025
CVE Published
via MITRE·06:11 AM
Data Sourced
via MITRE·06:11 AM
DescriptionWeakness
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-36469?
CVE-2024-36469 has a moderate severity level due to the potential for timing attacks on login credentials.
2
How do I fix CVE-2024-36469?
To fix CVE-2024-36469, ensure that the application has consistent timing responses for both valid and invalid login attempts.
3
Which software versions are affected by CVE-2024-36469?
CVE-2024-36469 affects all versions of Zabbix, especially those that do not implement uniform response times.
4
Can CVE-2024-36469 lead to account compromise?
Yes, CVE-2024-36469 can lead to account compromise by allowing attackers to discern valid usernames.
5
What kind of attack is associated with CVE-2024-36469?
CVE-2024-36469 is associated with timing attacks that exploit the difference in response times during login attempts.