CVEvulnerability

CVE-2019-15132

5.3 MEDIUM Published 2019-08-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-203

Description

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.

Affected configurations

• zabbix zabbix (<= 4.0.26) • zabbix zabbix (>= 5.0.0 <= 5.0.5) • zabbix zabbix (>= 5.2.0 <= 5.2.1) • zabbix zabbix 4.4.0 • debian debian linux 9.0

Related

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References