CVEvulnerability

CVE-2024-36466

8.8 HIGH Published 2024-11-28 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-11-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-290

Description

A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions.

Affected configurations

• zabbix zabbix (>= 6.0.0 < 6.0.32) • zabbix zabbix (>= 6.4.0 < 6.4.17) • zabbix zabbix 7.0.0

Related

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

References