CVE-2024-42325

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-359

Affected software

No affected versions have been published.

Timeline

Published: Apr 2, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-423264.4There was discovered a use after free bug in browser.c in the es_browser_get_variant function CVE-2024-423279.9A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vu CVE-2024-423285.5When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_w CVE-2024-423293.3The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this fun CVE-2024-42334.3Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, T CVE-2024-423309.1The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned CVE-2024-423313.3In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap p CVE-2024-423323.7The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of infor CVE-2024-423332.7The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedi CVE-2024-423355.47Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-423369.8Servision - CWE-287: Improper Authentication CVE-2024-423376.5CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor