Home

Description

An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabled or having restricted GUI access.

PUBLISHED Reserved 2024-05-28 | Published 2024-11-27 | Updated 2024-12-04 | Assigner Zabbix




HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-285 Improper Authorization

Product status

Default status
unaffected

5.0.0 (git)
affected

6.0.0 (git)
affected

6.4.0 (git)
affected

7.0.0 (git)
affected

Credits

Zabbix wants to thank Márk Rákóczi for submitting this report on the HackerOne bug bounty platform. reporter

References

support.zabbix.com/browse/ZBX-25614

cve.org (CVE-2024-36467)

nvd.nist.gov (CVE-2024-36467)

Download JSON