CVE-2019-15132

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-15132
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15132.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-15132
Related
Published
2019-08-17T18:15:10Z
Modified
2024-09-18T03:08:25.562533Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.

References

Affected packages

Debian:11 / zabbix

Package

Name
zabbix
Purl
pkg:deb/debian/zabbix?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:5.0.7+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / zabbix

Package

Name
zabbix
Purl
pkg:deb/debian/zabbix?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:5.0.7+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / zabbix

Package

Name
zabbix
Purl
pkg:deb/debian/zabbix?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:5.0.7+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/zabbix/zabbix

Affected ranges

Type
GIT
Repo
https://github.com/zabbix/zabbix
Events
Introduced
9665d62db0e4b40f8fadbcf830e06530a0cc6935
Last affected
eaa427cf19cf4511283bd0becfbd977567deec75

Affected versions

5.*

5.0.0
5.0.1
5.0.1rc1
5.0.2
5.0.2rc1
5.0.3
5.0.3.rc2
5.0.3rc1
5.0.3rc2
5.0.4
5.0.4rc1
5.0.5
5.0.5rc1