CVE-2014-1682

Zabbix <2.8.20rc1, <2.0.11rc1, <2.2.2rc1 - Auth Bypass

Title source: llm

Description

The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.

References (4)

[Various Sources] https://support.zabbix.com/browse/ZBX-7703

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/65402

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132376.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132377.html

Scores

EPSS 0.0025

EPSS Percentile 48.3%

Classification

CWE

CWE-287

Status draft

Affected Products (46)

zabbix/zabbix < 1.8.19

zabbix/zabbix

... and 31 more

Timeline

Published May 08, 2014

Tracked Since Feb 18, 2026