Skip to content
OpenAdvisories
High WID-SEC-2024-3556 3 CVEs

Zabbix: Mehrere Schwachstellen

Published Nov 26, 2024 · Updated Aug 10, 2025 · Revision 2 · de-DE

Vendor: SUSE Vendor: Zabbix Product: Linux Product: Zabbix Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Zabbix ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder seine Rechte zu erweitern.

Product

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Vulnerabilities 3

  • High 7.5
    CVE-2024-36467

    Authentication privilege escalation via user groups due to missing authorization checks

    An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabl…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 6.5
    CVE-2024-36463

    The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access interna…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Low 2.2
    CVE-2024-22117

    Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added

    When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysma…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu

Revision history

  1. #2

    Neue Updates von SUSE aufgenommen

  2. #1

    Initiale Fassung

References