Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-42325
CVE-2024-42325:
Zabbix Server vulnerability analysis and mitigation
Overview
A privacy vulnerability identified as CVE-2024-42325 was discovered in Zabbix API's user.get functionality. The vulnerability was reported on April 1, 2025, and affects multiple versions of Zabbix. The issue allows users to access sensitive information about other users who share common groups with the calling user (Zabbix Issue).
Technical details
The vulnerability exists in the Zabbix API's user.get function, which improperly returns excessive user information including media details and login attempt history for all users sharing a common group with the calling user. The vulnerability has been assigned a CVSS v4.0 Base Score of 2.1 (LOW) with the vector string CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. It has been classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) (NVD).
Impact
The vulnerability exposes sensitive user information including media details and login attempt history to other users within the same group. This unauthorized access to private information could potentially be used for reconnaissance or social engineering attacks (NVD).
Mitigation and workarounds
Fixed versions have been released including 5.0.46rc1, 6.0.38rc1, 7.0.9rc1, 7.2.3rc1, and 7.4.0alpha1. Users are advised to upgrade to these versions or later to address the vulnerability (Zabbix Issue).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management