{"id":"CVE-2024-36469","aliases":["DEBIAN-CVE-2024-36469","DLA-4131-1","EUVD-2024-54348","GHSA-8w6w-prh9-wr2j","SUSE-SU-2026:0483-1","UBUNTU-CVE-2024-36469"],"status":"published","title":"User enumeration via timing attack in Zabbix web interface","description":"Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00326,"percentile":0.2598,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2025-04-02T06:11:55Z","modified":"2026-11-02T12:02:41Z","fixes":[{"ecosystem":"Debian:13","package":"zabbix","fixed_in":["1:7.0.9+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zabbix","fixed_in":["1:7.0.9+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.0.14+dfsg-1","1:6.0.23+dfsg-1","1:6.0.23+dfsg-1~bpo12+1","1:6.0.24+dfsg-1","1:6.0.25+dfsg-1","1:6.0.29+dfsg-1","1:7.0.0+dfsg-1","1:7.0.0+dfsg-2","1:7.0.0+dfsg-2~bpo12+1","1:7.0.1+dfsg-1","1:7.0.1+dfsg-1~bpo12+1","1:7.0.10+dfsg-1","1:7.0.10+dfsg-2","1:7.0.2+dfsg-1","1:7.0.2+dfsg-1~bpo12+1","1:7.0.22+dfsg-1","1:7.0.22+dfsg-1.1","1:7.0.22+dfsg-1~bpo13+1","1:7.0.22+dfsg-1~deb13u1","1:7.0.27+dfsg-1","1:7.0.29+dfsg-1","1:7.0.29+dfsg-2","1:7.0.29+dfsg-2~bpo13+1","1:7.0.3+dfsg-1","1:7.0.5+dfsg-1","1:7.0.5+dfsg-1~bpo12+1","1:7.0.6+dfsg-1","1:7.0.9+dfsg-1","1:7.0.9+dfsg-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.9+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.9+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0.46+dfsg-1+deb11u1"}]}],"versions":["1:5.0.14+dfsg-1","1:5.0.14+dfsg-1~bpo11+1","1:5.0.17+dfsg-1","1:5.0.17+dfsg-1~bpo11+1","1:5.0.44+dfsg-1+deb11u1","1:5.0.45+dfsg-1+deb11u1","1:5.0.8+dfsg-1"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-4.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.0.6+dfsg-1ubuntu2","1:2.2.0+dfsg-1ubuntu1","1:2.2.0+dfsg-6ubuntu1","1:2.2.1+dfsg-1ubuntu3","1:2.2.2+dfsg-1ubuntu1","1:2.2.2+dfsg-1ubuntu1+esm1","1:2.2.2+dfsg-1ubuntu1+esm3","1:2.2.2+dfsg-1ubuntu1+esm4","1:2.2.2+dfsg-1ubuntu1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.4.6+dfsg-1","1:2.4.7+dfsg-1","1:2.4.7+dfsg-2","1:2.4.7+dfsg-2ubuntu2","1:2.4.7+dfsg-2ubuntu2.1","1:2.4.7+dfsg-2ubuntu2.1+esm1","1:2.4.7+dfsg-2ubuntu2.1+esm2","1:2.4.7+dfsg-2ubuntu2.1+esm3","1:2.4.7+dfsg-2ubuntu2.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.0.7+dfsg-3","1:3.0.12+dfsg-1","1:3.0.12+dfsg-1ubuntu0.1~esm1","1:3.0.12+dfsg-1ubuntu0.1~esm2","1:3.0.12+dfsg-1ubuntu0.1~esm3","1:3.0.12+dfsg-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.0.4+dfsg-1build2","1:4.0.4+dfsg-1build3","1:4.0.11+dfsg-1","1:4.0.14+dfsg-1","1:4.0.15+dfsg-1","1:4.0.16+dfsg-1","1:4.0.16+dfsg-1build1","1:4.0.17+dfsg-1","1:4.0.17+dfsg-1ubuntu0.1~esm1","1:4.0.17+dfsg-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.0.8+dfsg-1build1","1:5.0.14+dfsg-1","1:5.0.17+dfsg-1","1:5.0.17+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.10+dfsg-2","1:7.0.10+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.22+dfsg-1","1:7.0.22+dfsg-1.1","1:7.0.22+dfsg-1.1build1","1:7.0.22+dfsg-1.1build2","1:7.0.27+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.10+dfsg-2build1","1:7.0.22+dfsg-1"]}],"products":[{"vendor":"zabbix","product":"zabbix"}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-26255","tags":["Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00027.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36469"},{"url":"https://github.com/advisories/GHSA-8w6w-prh9-wr2j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-36469","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260483-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240676","tags":["report"]},{"url":"https://bugzilla.suse.com/1240678","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42325","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-36469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-36469","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-36469","title":"User enumeration via timing attack in Zabbix web interface","description":"Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.","status":"published","published":"2025-04-02T06:11:55Z","modified":"2025-11-03T19:30:06.293Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-54348","description":"Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.","status":"published","published":"2025-04-02T06:11:55Z","modified":"2025-11-03T19:30:06Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-8w6w-prh9-wr2j","title":"Execution time for an unsuccessful login differs when using a non-existing username compared to...","description":"Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.","status":"published","published":"2025-04-02T09:30:33Z","modified":"2025-11-03T21:33:29Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:04:22.666827Z"}],"nvd":[{"id":"CVE-2024-36469","description":"Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.","status":"published","published":"2025-04-02T07:15:40.147Z","modified":"2026-06-17T07:36:47.093Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"CVE-2024-36469","description":"Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.","status":"published","published":"2025-04-02T07:15:40.147Z","modified":"2026-10-24T14:23:35.905130974Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"DEBIAN-CVE-2024-36469","description":"Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.","status":"published","published":"2025-04-02T07:15:40.147Z","modified":"2026-11-02T12:02:41.001683865Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"UBUNTU-CVE-2024-36469","description":"Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.","status":"published","published":"2025-04-02T07:15:00Z","modified":"2026-10-17T12:56:37.457548194Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"DLA-4131-1","title":"zabbix - security update","status":"published","published":"2025-04-19T00:00:00Z","modified":"2026-03-09T01:17:53.288745Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"SUSE-SU-2026:0483-1","title":"Security update for zabbix","description":"This update for zabbix fixes the following issues:\n\n- CVE-2024-36469: Introduced clamping for mitigation of timing attacks. (bsc#1240676)\n- CVE-2024-42325: Restricted access to user fields using user.get API method for users of User and Admin type, and restricted access to alert entities using alert.get API method for users of User and Admin types. (bsc#1240678)\n","status":"published","published":"2026-02-12T16:34:19Z","modified":"2026-02-13T16:42:49.231448Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}