Home

Description

When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords.

PUBLISHED Reserved 2024-05-28 | Published 2024-11-27 | Updated 2025-11-03 | Assigner Zabbix




LOW: 2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-256 Plaintext Storage of a Password

Product status

Default status
unaffected

6.0.0 (git)
affected

6.4.0 (git)
affected

7.0.0alpha1 (git)
affected

Credits

Zabbix wants to thank Jayateertha G for submitting this report on the HackerOne bug bounty platform. reporter

References

lists.debian.org/debian-lts-announce/2024/12/msg00005.html

support.zabbix.com/browse/ZBX-25630

cve.org (CVE-2024-36464)

nvd.nist.gov (CVE-2024-36464)

Download JSON