CVE-2024-36467 — Authentication privilege escalation via user groups due to missing authorization checks

CVE-2024-36467

Authentication privilege escalation via user groups due to missing authorization checks PUBLISHED

Description (CNA)

An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabled or having restricted GUI access.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 5.0.0 through 5.0.42; affected 6.0.0 through 6.0.32; affected 6.4.0 through 6.4.17; affected 7.0.0 through 7.0.1rc1

CWE

CWE-285

References

https://support.zabbix.com/browse/ZBX-25614

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.