CVE-2013-5572

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging...

3.5 LowPublic exploitFix available

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

Exploit likelihood

4.11%Down 3.2 points since Feb 4, 2022

What each source reports

NVD Score used 3.5

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

Record: CVE-2013-5572
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:P/I:N/A:N
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

Record: CVE-2013-5572
Updated: 2026-11-02

EUVDEUVD-2013-5412 No score

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

Record: EUVD-2013-5412
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c47p-v2q9-c4rg No score

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging...

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

Record: GHSA-c47p-v2q9-c4rg
Updated: 2026-11-02

OSV No score

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

Record: CVE-2013-5572
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-5572 No score

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

Record: DEBIAN-CVE-2013-5572
Updated: 2026-11-02

OSVMGASA-2014-0095 No score

Updated zabbix packages fix multiple vulnerabilities

Updated zabbix packages fix security vulnerabilities:

Zabbix before 2.0.11 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code (CVE-2013-5572).

Zabbix before 2.0.11 allows switching users without proper credentials when using HTTP authentication (CVE-2014-1682).

In Zabbix before 2.0.11, the admin user is able to update media for other users (CVE-2014-1685).

Record: MGASA-2014-0095
Updated: 2026-11-02

Affected products

zabbix

Affected packages

Affected packages
Package	Affected	Fixed
`zabbix` Debian:12	before 1:2.2.2+dfsg-1	1:2.2.2+dfsg-1
`zabbix` Debian:13	before 1:2.2.2+dfsg-1	1:2.2.2+dfsg-1
`zabbix` Debian:14	before 1:2.2.2+dfsg-1	1:2.2.2+dfsg-1
`zabbix` Mageia:3 From an advisory covering 3 CVEs	before 2.0.11-1.mga3	2.0.11-1.mga3
`zabbix` Mageia:4 From an advisory covering 3 CVEs	before 2.0.11-1.mga4	2.0.11-1.mga4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Zabbix 2.0.5 - Cleartext ldap_bind_Password Password Disclosure (Metasploit)	2015-02-23

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-5572 is a low vulnerability (CVSS 3.5) in Zabbix, published October 1, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.11%, the 90th percentile. Fixed in zabbix 1:2.2.2+dfsg-1.

References

Show 6 moreShow less