Skip to content
OpenAdvisories
High WID-SEC-2025-0671 5 CVEs

Zabbix: Mehrere Schwachstellen

Published Mar 31, 2025 · Updated Feb 12, 2026 · Revision 6 · de-DE

Vendor: Debian Vendor: Fedora Vendor: SUSE Vendor: Zabbix Product: Linux Product: Linux Product: Linux Product: Zabbix

Summary

Ein Angreifer kann mehrere Schwachstellen in Zabbix ausnutzen, um beliebigen Code auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen.

Product

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Vulnerabilities 5

  • High 8.6
    CVE-2024-36465 EPSS 40%

    SQL injection in Zabbix API

    A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • High 7.5
    CVE-2024-45699

    Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps

    The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScrip…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 6.0
    CVE-2024-45700

    DoS vulnerability due to uncontrolled resource exhaustion

    Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompre…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Low 2.3
    CVE-2024-36469

    User enumeration via timing attack in Zabbix web interface

    Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Low 2.1
    CVE-2024-42325

    Excessive information returned by user.get

    Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu

Revision history

  1. #6

    Neue Updates von SUSE aufgenommen

  2. #5

    PoC für CVE-2024-45699 aufgenommen

  3. #4

    Neue Updates von Debian aufgenommen

  4. #3

    Neue Updates von Fedora aufgenommen

  5. #2

    Neue Updates von Fedora aufgenommen

  6. #1

    Initiale Fassung

References