certfr_avis - certfr-2025-avi-0840

CERTFR-2025-AVI-0840

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans Zabbix. Elles permettent à un attaquant de provoquer une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Zabbix	Zabbix	Zabbix versions 6.0.x antérieures à 6.0.41
Zabbix	N/A	Zabbix Agent versions 7.2.x antérieures à 7.2.12
Zabbix	Zabbix	Zabbix versions 7.0.x antérieures à 7.0.17
Zabbix	Zabbix	Zabbix versions 7.2.x antérieures à 7.2.11
Zabbix	N/A	Zabbix Agent versions 6.0.x antérieures à 6.0.41
Zabbix	N/A	Zabbix Agent versions 7.0.x antérieures à 7.0.18
Zabbix	N/A	Zabbix Agent versions 7.4.x antérieures à 7.4.2
Zabbix	Zabbix	Zabbix versions 7.4.x antérieures à 7.4.1

References

Title

Publication Time

Tags

Bulletin de sécurité Zabbix ZBX-27060	2025-10-03	vendor-advisory
Bulletin de sécurité Zabbix ZBX-27061	2025-10-03	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Zabbix versions 6.0.x ant\u00e9rieures \u00e0 6.0.41",
      "product": {
        "name": "Zabbix",
        "vendor": {
          "name": "Zabbix",
          "scada": false
        }
      }
    },
    {
      "description": "Zabbix Agent versions 7.2.x ant\u00e9rieures \u00e0 7.2.12",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Zabbix",
          "scada": false
        }
      }
    },
    {
      "description": "Zabbix versions 7.0.x ant\u00e9rieures \u00e0 7.0.17",
      "product": {
        "name": "Zabbix",
        "vendor": {
          "name": "Zabbix",
          "scada": false
        }
      }
    },
    {
      "description": "Zabbix versions 7.2.x ant\u00e9rieures \u00e0 7.2.11",
      "product": {
        "name": "Zabbix",
        "vendor": {
          "name": "Zabbix",
          "scada": false
        }
      }
    },
    {
      "description": "Zabbix Agent versions 6.0.x ant\u00e9rieures \u00e0 6.0.41",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Zabbix",
          "scada": false
        }
      }
    },
    {
      "description": "Zabbix Agent versions 7.0.x ant\u00e9rieures \u00e0 7.0.18",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Zabbix",
          "scada": false
        }
      }
    },
    {
      "description": "Zabbix Agent versions 7.4.x ant\u00e9rieures \u00e0 7.4.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Zabbix",
          "scada": false
        }
      }
    },
    {
      "description": "Zabbix versions 7.4.x ant\u00e9rieures \u00e0 7.4.1",
      "product": {
        "name": "Zabbix",
        "vendor": {
          "name": "Zabbix",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-27236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27236"
    },
    {
      "name": "CVE-2025-27237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27237"
    }
  ],
  "initial_release_date": "2025-10-03T00:00:00",
  "last_revision_date": "2025-10-03T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0840",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-10-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Zabbix. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Zabbix",
  "vendor_advisories": [
    {
      "published_at": "2025-10-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Zabbix ZBX-27060",
      "url": "https://support.zabbix.com/browse/ZBX-27060"
    },
    {
      "published_at": "2025-10-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Zabbix ZBX-27061",
      "url": "https://support.zabbix.com/browse/ZBX-27061"
    }
  ]
}

CVE-2025-27236 (GCVE-0-2025-27236)

Vulnerability from cvelistv5

Published

2025-10-03 11:28

Modified

2025-10-03 13:52

Severity ?

2.1 (Low) - CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-863 - Incorrect Authorization

Summary

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.

References

URL

Tags

https://support.zabbix.com/browse/ZBX-27060

Impacted products

	Vendor	Product	Version
	Zabbix	Zabbix	Version: 6.0.38 Version: 7.0.9 Version: 7.2.3 Version: 7.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27236",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-03T13:52:30.190057Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-03T13:52:36.578Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Frontend"
          ],
          "product": "Zabbix",
          "repo": "https://git.zabbix.com/",
          "vendor": "Zabbix",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.0.41",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.0.40",
              "status": "affected",
              "version": "6.0.38",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.0.17",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.0.16",
              "status": "affected",
              "version": "7.0.9",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.2.11",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.2.10",
              "status": "affected",
              "version": "7.2.3",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.4.1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "7.4.1",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn authenticated, regular Zabbix user could data-mine some field values on other users in their group.\u003c/p\u003e"
            }
          ],
          "value": "An authenticated, regular Zabbix user could data-mine some field values on other users in their group."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Zabbix wants to thank yannapostrophe and exod for submitting this report on the HackerOne bug bounty platform."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.\u003c/p\u003e"
            }
          ],
          "value": "A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-116",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-116: Excavation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-03T11:28:09.810Z",
        "orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
        "shortName": "Zabbix"
      },
      "references": [
        {
          "url": "https://support.zabbix.com/browse/ZBX-27060"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate the affected components to their respective fixed versions.\u003c/p\u003e"
            }
          ],
          "value": "Update the affected components to their respective fixed versions."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "User information disclosure via api_jsonrpc.php on method user.get with param search",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
    "assignerShortName": "Zabbix",
    "cveId": "CVE-2025-27236",
    "datePublished": "2025-10-03T11:28:09.810Z",
    "dateReserved": "2025-02-20T11:40:38.480Z",
    "dateUpdated": "2025-10-03T13:52:36.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-27237 (GCVE-0-2025-27237)

Vulnerability from cvelistv5

Published

2025-10-03 11:28

Modified

2025-10-04 03:55

Severity ?

7.3 (High) - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-427 - Uncontrolled Search Path Element

Summary

In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.

References

URL

Tags

https://support.zabbix.com/browse/ZBX-27061

Impacted products

	Vendor	Product	Version
	Zabbix	Zabbix	Version: 6.0.0 Version: 7.0.0 Version: 7.2.0 Version: 7.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27237",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-03T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-04T03:55:24.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Agent",
            "Agent2"
          ],
          "product": "Zabbix",
          "repo": "https://git.zabbix.com/",
          "vendor": "Zabbix",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.0.41",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.0.40",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.0.18",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.0.17",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.2.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.2.11",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.4.2",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.4.1",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA local Windows user with Zabbix Agent installed could modify the OpenSSL configuration file, but this file is only loaded after Zabbix Agent or the system restarts.\u003c/p\u003e"
            }
          ],
          "value": "A local Windows user with Zabbix Agent installed could modify the OpenSSL configuration file, but this file is only loaded after Zabbix Agent or the system restarts."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Zabbix wants to thank himbeer for submitting this report on the HackerOne bug bounty platform."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.\u003c/p\u003e"
            }
          ],
          "value": "In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-471",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-471: Search Order Hijacking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427: Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-03T11:28:43.076Z",
        "orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
        "shortName": "Zabbix"
      },
      "references": [
        {
          "url": "https://support.zabbix.com/browse/ZBX-27061"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate the affected components to their respective fixed versions.\u003c/p\u003e"
            }
          ],
          "value": "Update the affected components to their respective fixed versions."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
    "assignerShortName": "Zabbix",
    "cveId": "CVE-2025-27237",
    "datePublished": "2025-10-03T11:28:43.076Z",
    "dateReserved": "2025-02-20T11:40:38.480Z",
    "dateUpdated": "2025-10-04T03:55:24.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2025-AVI-0840

Vulnerability from certfr_avis

Solutions

CVE-2025-27236 (GCVE-0-2025-27236)

Vulnerability from cvelistv5

CVE-2025-27237 (GCVE-0-2025-27237)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature