CVE-2014-1682
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows...
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
Exploit likelihood
What each source reports
NVD Score used
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
- Record
CVE-2014-1682- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
- Record
CVE-2014-1682- Updated
- 2026-11-02
EUVDEUVD-2014-1756 No score
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
- Record
EUVD-2014-1756- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hvm5-hr24-54m2 No score
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows...
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
- Record
GHSA-hvm5-hr24-54m2- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
- Record
CVE-2014-1682- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-1682 No score
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
- Record
DEBIAN-CVE-2014-1682- Updated
- 2026-11-02
OSVMGASA-2014-0095 No score
Updated zabbix packages fix multiple vulnerabilities
Updated zabbix packages fix security vulnerabilities:
Zabbix before 2.0.11 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code (CVE-2013-5572).
Zabbix before 2.0.11 allows switching users without proper credentials when using HTTP authentication (CVE-2014-1682).
In Zabbix before 2.0.11, the admin user is able to update media for other users (CVE-2014-1685).
- Record
MGASA-2014-0095- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zabbixDebian:12 |
before 1:2.2.2+dfsg-1 | 1:2.2.2+dfsg-1 |
zabbixDebian:13 |
before 1:2.2.2+dfsg-1 | 1:2.2.2+dfsg-1 |
zabbixDebian:14 |
before 1:2.2.2+dfsg-1 | 1:2.2.2+dfsg-1 |
zabbixMageia:3 From an advisory covering 3 CVEs |
before 2.0.11-1.mga3 | 2.0.11-1.mga3 |
zabbixMageia:4 From an advisory covering 3 CVEs |
before 2.0.11-1.mga4 | 2.0.11-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1682 is a medium vulnerability (CVSS 4.0) in Zabbix, published February 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in zabbix 1:2.2.2+dfsg-1.