UpHeron
All vulnerabilities

Servers and applications

CVE-2019-15132

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.

Severity
Medium 5.3
Published
17 Aug 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2% in the next 30 daysHigher than 81% of CVEs. EPSS by FIRST, 10 Nov 2026
Weakness
Observable discrepancy (CWE-203)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Sources
NVD

Affected software

SoftwareAffected versions
ZabbixServers and applications · cpe:a:zabbix:zabbix
  • Every version up to 4.0.26
  • Version 4.4.0-alpha1
  • From 5.0.0 up to 5.0.5
  • From 5.2.0 up to 5.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-15132
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-15132