PT-2024-9179 · Zabbix+4 · Zabbix+4

Vjaceslavs Bogdanovs · Published 2024-05-28 · Updated 2025-11-11 · CVE-2024-36466

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Zabbix (affected versions not specified)

Description: A bug in the code allows an attacker to sign a forged zbx session cookie, which then allows them to sign in with admin permissions. This issue is related to the authentication mechanism, specifically allowing attackers to bypass authentication via spoofing. Exploitation of this issue can enable a remote attacker to bypass existing security restrictions and elevate their privileges using a specially crafted signed zbx session cookie.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

ALT-PU-2024-16527

ALT-PU-2024-16638

BDU:2024-10866

CVE-2024-36466

Affected Products

Alt Linux

Astra Linux

Debian

Red Os

Zabbix

References · 31

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-36466 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-36466 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-36466 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36466 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10866 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/714649 · Security Note
• https://support.zabbix.com/browse/ZBX-25635 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36466 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-36466 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36466 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE47 · Vendor Advisory