PT-2019-6332 · Zabbix+3 · Zabbix+3

Published 2019-05-20 · Updated 2023-04-12 · CVE-2019-15132

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zabbix versions through 4.4.0alpha1

Description The issue allows for user enumeration based on the variability of server responses to login requests. This can be achieved through the "Login name or password is incorrect" and "No permissions for system access" messages, or by the server blocking for a number of seconds. Both api jsonrpc.php and index.php are affected. The vulnerability can be exploited by sending specially crafted requests, potentially allowing a remote attacker to gain unauthorized access to protected information.

Recommendations For Zabbix versions through 4.4.0alpha1, consider restricting access to api jsonrpc.php and index.php to minimize the risk of exploitation until a patch is available. As a temporary workaround, modifying the server response to be consistent for all login attempts could help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

ALT-PU-2019-1862

ALT-PU-2020-1083

ALT-PU-2020-3446

ALT-PU-2021-2018

BDU:2023-02341

CVE-2019-15132

DLA-2631-1

DLA-3390-1

USN-4767-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Zabbix

References · 32

• https://ubuntu.com/security/CVE-2016-4338 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15132 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15803 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3005 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15132 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10742 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02341 · Security Note
• https://osv.dev/vulnerability/DLA-2631-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3390-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-15132 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4767-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2824 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4767-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15132 · Vendor Advisory