CVE-2019-15132

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-08-17 · updated 2026-06-17
Weakness: CWE-203

Description

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.

Affected products

Debian Linux: 9.0
Zabbix: through 4.0.26; from 5.0.0 through 5.0.5; from 5.2.0 through 5.2.1; 4.4.0-alpha1

References

https://lists.debian.org/debian-lts-announce/2021/04/msg00018.html
https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html
https://support.zabbix.com/browse/ZBX-16532
https://lists.debian.org/debian-lts-announce/2021/04/msg00018.html
https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html
https://support.zabbix.com/browse/ZBX-16532

Get alerted when CVE-2019-15132 or the next vulnerability affects your stack