CVE-2024-42325: Excessive information returned by user.get
Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/zabbixto a version that resolves this vulnerability.Fixed in 1:7.0.9+dfsg-1 - Upgrade
Upgrade
debian/zabbixto a version that resolves this vulnerability.Fixed in 1:7.0.22+dfsg-1~deb13u1Fixed in 1:7.0.29+dfsg-2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42325?
The severity of CVE-2024-42325 is classified as medium, indicating potential risks to user data.
How do I fix CVE-2024-42325?
To fix CVE-2024-42325, update to the latest version of Zabbix that addresses the vulnerability.
What kind of information is exposed by CVE-2024-42325?
CVE-2024-42325 exposes sensitive user information including media, login attempts, and other related data.
Which users are affected by CVE-2024-42325?
Users belonging to the same groups as the calling user can be affected by CVE-2024-42325 due to shared access.
Is CVE-2024-42325 a remote vulnerability?
Yes, CVE-2024-42325 can be exploited remotely through the Zabbix API.