← CVE Intelligence

CVE-2025-27231

LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin PUBLISHED

Description (CNA)

The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.

Affected (CNA)

Vendor / productVersions
Zabbix / Zabbixaffected 6.0.0 through 6.0.40; affected 7.0.0 through 7.0.17; affected 7.2.0 through 7.2.11; affected 7.4.0 through 7.4.1

CWE

CWE-522

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.