{"id":"CVE-2024-42325","aliases":["DEBIAN-CVE-2024-42325","DLA-4131-1","EUVD-2024-54347","GHSA-pphq-xpjc-vgqx","SUSE-SU-2026:0483-1","UBUNTU-CVE-2024-42325"],"status":"published","title":"Excessive information returned by user.get","description":"Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.003,"percentile":0.22984,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-359"],"published":"2025-04-02T06:12:24Z","modified":"2026-11-02T12:02:47Z","fixes":[{"ecosystem":"Debian:13","package":"zabbix","fixed_in":["1:7.0.9+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zabbix","fixed_in":["1:7.0.9+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.0.14+dfsg-1","1:6.0.23+dfsg-1","1:6.0.23+dfsg-1~bpo12+1","1:6.0.24+dfsg-1","1:6.0.25+dfsg-1","1:6.0.29+dfsg-1","1:7.0.0+dfsg-1","1:7.0.0+dfsg-2","1:7.0.0+dfsg-2~bpo12+1","1:7.0.1+dfsg-1","1:7.0.1+dfsg-1~bpo12+1","1:7.0.10+dfsg-1","1:7.0.10+dfsg-2","1:7.0.2+dfsg-1","1:7.0.2+dfsg-1~bpo12+1","1:7.0.22+dfsg-1","1:7.0.22+dfsg-1.1","1:7.0.22+dfsg-1~bpo13+1","1:7.0.22+dfsg-1~deb13u1","1:7.0.27+dfsg-1","1:7.0.29+dfsg-1","1:7.0.29+dfsg-2","1:7.0.29+dfsg-2~bpo13+1","1:7.0.3+dfsg-1","1:7.0.5+dfsg-1","1:7.0.5+dfsg-1~bpo12+1","1:7.0.6+dfsg-1","1:7.0.9+dfsg-1","1:7.0.9+dfsg-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.9+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.9+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0.46+dfsg-1+deb11u1"}]}],"versions":["1:5.0.14+dfsg-1","1:5.0.14+dfsg-1~bpo11+1","1:5.0.17+dfsg-1","1:5.0.17+dfsg-1~bpo11+1","1:5.0.44+dfsg-1+deb11u1","1:5.0.45+dfsg-1+deb11u1","1:5.0.8+dfsg-1"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-4.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.0.6+dfsg-1ubuntu2","1:2.2.0+dfsg-1ubuntu1","1:2.2.0+dfsg-6ubuntu1","1:2.2.1+dfsg-1ubuntu3","1:2.2.2+dfsg-1ubuntu1","1:2.2.2+dfsg-1ubuntu1+esm1","1:2.2.2+dfsg-1ubuntu1+esm3","1:2.2.2+dfsg-1ubuntu1+esm4","1:2.2.2+dfsg-1ubuntu1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.4.6+dfsg-1","1:2.4.7+dfsg-1","1:2.4.7+dfsg-2","1:2.4.7+dfsg-2ubuntu2","1:2.4.7+dfsg-2ubuntu2.1","1:2.4.7+dfsg-2ubuntu2.1+esm1","1:2.4.7+dfsg-2ubuntu2.1+esm2","1:2.4.7+dfsg-2ubuntu2.1+esm3","1:2.4.7+dfsg-2ubuntu2.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.0.7+dfsg-3","1:3.0.12+dfsg-1","1:3.0.12+dfsg-1ubuntu0.1~esm1","1:3.0.12+dfsg-1ubuntu0.1~esm2","1:3.0.12+dfsg-1ubuntu0.1~esm3","1:3.0.12+dfsg-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.0.4+dfsg-1build2","1:4.0.4+dfsg-1build3","1:4.0.11+dfsg-1","1:4.0.14+dfsg-1","1:4.0.15+dfsg-1","1:4.0.16+dfsg-1","1:4.0.16+dfsg-1build1","1:4.0.17+dfsg-1","1:4.0.17+dfsg-1ubuntu0.1~esm1","1:4.0.17+dfsg-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.0.8+dfsg-1build1","1:5.0.14+dfsg-1","1:5.0.17+dfsg-1","1:5.0.17+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.10+dfsg-2","1:7.0.10+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.22+dfsg-1","1:7.0.22+dfsg-1.1","1:7.0.22+dfsg-1.1build1","1:7.0.22+dfsg-1.1build2","1:7.0.27+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.0.10+dfsg-2build1","1:7.0.22+dfsg-1"]}],"products":[{"vendor":"zabbix","product":"zabbix"}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-26258","tags":["Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00027.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42325"},{"url":"https://github.com/advisories/GHSA-pphq-xpjc-vgqx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-42325","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260483-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240676","tags":["report"]},{"url":"https://bugzilla.suse.com/1240678","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42325","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-42325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42325","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-42325","title":"Excessive information returned by user.get","description":"Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.","status":"published","published":"2025-04-02T06:12:24.516Z","modified":"2025-11-03T19:30:34.9Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T14:34:03.00063Z"}],"euvd":[{"id":"EUVD-2024-54347","description":"Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.","status":"published","published":"2025-04-02T06:12:24Z","modified":"2025-11-03T19:30:34Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-pphq-xpjc-vgqx","title":"Zabbix API user.get returns all users that share common group with the calling user. This...","description":"Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.","status":"published","published":"2025-04-02T09:30:33Z","modified":"2025-11-03T21:34:29Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T15:04:24.41654Z"}],"nvd":[{"id":"CVE-2024-42325","description":"Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.","status":"published","published":"2025-04-02T07:15:41.24Z","modified":"2026-06-17T07:49:15.803Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"CVE-2024-42325","description":"Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.","status":"published","published":"2025-04-02T07:15:41.24Z","modified":"2026-10-24T14:36:23.872915394Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DEBIAN-CVE-2024-42325","description":"Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.","status":"published","published":"2025-04-02T07:15:41.24Z","modified":"2026-11-02T12:02:47.096130139Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"UBUNTU-CVE-2024-42325","description":"Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.","status":"published","published":"2025-04-02T07:15:00Z","modified":"2026-10-17T12:57:23.185326389Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"DLA-4131-1","title":"zabbix - security update","status":"published","published":"2025-04-19T00:00:00Z","modified":"2026-03-09T01:17:53.288745Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"SUSE-SU-2026:0483-1","title":"Security update for zabbix","description":"This update for zabbix fixes the following issues:\n\n- CVE-2024-36469: Introduced clamping for mitigation of timing attacks. (bsc#1240676)\n- CVE-2024-42325: Restricted access to user fields using user.get API method for users of User and Admin type, and restricted access to alert entities using alert.get API method for users of User and Admin types. (bsc#1240678)\n","status":"published","published":"2026-02-12T16:34:19Z","modified":"2026-02-13T16:42:49.231448Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}