What’s Vulnerable › Vulnerabilities

CVE-2024-22114: System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-12 · updated 2026-06-17
• Weakness: CWE-281

Description

User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.

Affected products

• Zabbix: from 5.0.0 through 5.0.42; from 6.0.0 through 6.0.30; from 6.4.0 through 6.4.15; 7.0.0-alpha1, 7.0.0-alpha2, 7.0.0-alpha3, 7.0.0-alpha4, 7.0.0-alpha5, 7.0.0-alpha6 (+8)

References

• https://support.zabbix.com/browse/ZBX-25015
• https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html

Get alerted when CVE-2024-22114 or the next vulnerability affects your stack