Description
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
References (4)
Core 4
Core References
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132377.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/65402
Various Sources x_refsource_confirm
https://support.zabbix.com/browse/ZBX-7703
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132376.html
Scores
EPSS
0.0157
EPSS Percentile
72.2%
Details
CWE
CWE-287
Status
published
Products (23)
fedoraproject/fedora
19
fedoraproject/fedora
20
zabbix/zabbix
1.8
zabbix/zabbix
1.8.1
zabbix/zabbix
1.8.2
zabbix/zabbix
1.8.3 rc1 (3 CPE variants)
zabbix/zabbix
1.8.15 rc1
zabbix/zabbix
1.8.16
zabbix/zabbix
1.8.18
zabbix/zabbix
2.0.0 (7 CPE variants)
... and 13 more
Published
May 08, 2014
Tracked Since
Feb 18, 2026