CVE-2024-36469: 
Zabbix Server vulnerability analysis and mitigation

A timing attack vulnerability (CVE-2024-36469) was discovered in Zabbix frontend login form and API. The vulnerability was disclosed on April 1, 2025, and allows user enumeration through timing differences in login attempts. The issue affects multiple versions of Zabbix, including versions 5.0.x, 6.0.x, and 7.0.x (Zabbix Issue).

The vulnerability is classified as CWE-208 (Observable Timing Discrepancy). The core issue lies in the different execution times for unsuccessful login attempts when using non-existing usernames compared to existing ones, potentially allowing attackers to enumerate valid usernames. The vulnerability has been assigned a CVSS 4.0 Base Score of 2.3 (LOW) with the vector string CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (NVD Database).

The vulnerability could allow attackers to enumerate valid usernames in the Zabbix system through timing analysis of login attempts. This information could be potentially used as a stepping stone for further attacks by identifying valid user accounts (CVE Database).

Fixed versions have been released: 5.0.46rc1, 6.0.38rc1, 7.0.9rc1, 7.2.3rc1, and 7.4.0alpha1. Users are advised to upgrade to these versions or later to address the vulnerability (Zabbix Issue).