Servers and applications
CVE-2014-1682 The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
Severity Medium 4.0
Published 8 May 2014
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 1.6% in the next 30 daysHigher than 75% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · Needs a login
Attacker can Change some data
CVSS vector AV:N/AC:L/Au:S/C:N/I:P/A:N
Sources NVD Affected software Software Affected versions ZabbixServers and applications · cpe:a:zabbix:zabbix Version 2.2.1 Version 2.2.1-rc1 Version 2.2.0 Version 2.2.0-rc2 All 43 release lines Every version up to 1.8.19 Version 1.8 Version 1.8.1 Version 1.8.2 Version 1.8.3-rc1 Version 1.8.3-rc2 Version 1.8.3-rc3 Version 1.8.15-rc1 Version 1.8.16 Version 1.8.18 Version 2.0.0-rc1 Version 2.0.0-rc2 Version 2.0.0-rc3 Version 2.0.0-rc4 Version 2.0.0-rc5 Version 2.0.0-rc6 Version 2.0.0 Version 2.0.1-rc1 Version 2.0.1-rc2 Version 2.0.1 Version 2.0.2-rc1 Version 2.0.2-rc2 Version 2.0.2 Version 2.0.3-rc1 Version 2.0.3-rc2 Version 2.0.3 Version 2.0.4-rc1 Version 2.0.4 Version 2.0.5-rc1 Version 2.0.5 Version 2.0.6-rc1 Version 2.0.6 Version 2.0.7-rc1 Version 2.0.8-rc1 Version 2.0.8-rc2 Version 2.0.9-rc1 Version 2.0.9-rc2 Version 2.0.10-rc1 Version 2.2.0-rc1 Version 2.2.0-rc2 Version 2.2.0 Version 2.2.1-rc1 Version 2.2.1
References NVD https://nvd.nist.gov/vuln/detail/CVE-2014-1682 CVE.org https://www.cve.org/CVERecord?id=CVE-2014-1682