#VU101284 Missing authorization in Zabbix - CVE-2024-36467

Vulnerability identifier: #VU101284

Vulnerability risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-36467

CWE-ID: CWE-862

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Zabbix
Server applications / Remote management servers, RDP, SSH

Vendor: Zabbix

Description

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to missing authorization checks within the API. A remote user with access to the user.update API endpoint can assign an administrative group to their account and escalate privileges within the application.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Zabbix: 5.0.0 rc1 - 5.0.42, 5.2.0 - 5.2.7, 5.4.0 rc1 - 5.4.12, 6.0.0 rc1 - 6.0.32, 6.2.0 rc1 - 6.2.9, 6.4.0 rc1 - 6.4.17, 7.0.0 alpha1 - 7.0.1

---

External links
https://support.zabbix.com/browse/ZBX-25614

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.