CVE-2025-27238 - Vulnerability Details - OpenCVE

Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Zabbix	Zabbix

No data.

No data.

References

Link	Providers
https://support.zabbix.com/browse/ZBX-26988

History

Mon, 15 Sep 2025 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284

Mon, 15 Sep 2025 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zabbix Zabbix zabbix
Vendors & Products		Zabbix Zabbix zabbix

Fri, 12 Sep 2025 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 12 Sep 2025 10:45:00 +0000

Type	Values Removed	Values Added
Description		Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
Title		API hostprototype.get lists data to users with insufficient authorization.
References		https://support.zabbix.com/browse/ZBX-26988
Metrics		cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Zabbix

Published: 2025-09-12T10:33:17.753Z

Updated: 2025-09-15T18:48:19.882Z

Reserved: 2025-02-20T11:40:38.480Z

Link: CVE-2025-27238

Vulnrichment

Updated: 2025-09-12T11:54:32.704Z

NVD

Status : Awaiting Analysis

Published: 2025-09-12T11:15:31.517

Modified: 2025-09-15T19:15:34.553

Link: CVE-2025-27238

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27238", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "state": "PUBLISHED", "assignerShortName": "Zabbix", "dateReserved": "2025-02-20T11:40:38.480Z", "datePublished": "2025-09-12T10:33:17.753Z", "dateUpdated": "2025-09-15T18:48:19.882Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["API"], "product": "Zabbix", "repo": "https://git.zabbix.com/", "vendor": "Zabbix", "versions": [{"changes": [{"at": "7.0.14", "status": "unaffected"}], "lessThanOrEqual": "7.0.13", "status": "affected", "version": "7.0.0", "versionType": "git"}, {"changes": [{"at": "7.2.8", "status": "unaffected"}], "lessThanOrEqual": "7.2.7", "status": "affected", "version": "7.2.0", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An attacker could retrieve a list of all host prototypes from API if they have access to a low privilege user account with no user roles assigned.</p>"}], "value": "An attacker could retrieve a list of all host prototypes from API if they have access to a low privilege user account with no user roles assigned."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.</p>"}], "value": "Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them."}], "impacts": [{"descriptions": [{"lang": "en", "value": ":"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 2.1, "baseSeverity": "LOW", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": ":", "lang": "en"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2025-09-12T10:33:17.753Z"}, "references": [{"url": "https://support.zabbix.com/browse/ZBX-26988"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update the affected components to their respective fixed versions.</p>"}], "value": "Update the affected components to their respective fixed versions."}], "source": {"discovery": "INTERNAL"}, "title": "API hostprototype.get lists data to users with insufficient authorization.", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Make sure there are no Zabbix users without a user group.</p>"}], "value": "Make sure there are no Zabbix users without a user group."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-12T11:54:14.863048Z", "id": "CVE-2025-27238", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-15T18:48:19.882Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27238", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-12T11:54:14.863048Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T11:54:32.704Z"}}], "cna": {"title": "API hostprototype.get lists data to users with insufficient authorization.", "source": {"discovery": "INTERNAL"}, "impacts": [{"descriptions": [{"lang": "en", "value": ":"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.zabbix.com/", "vendor": "Zabbix", "modules": ["API"], "product": "Zabbix", "versions": [{"status": "affected", "changes": [{"at": "7.0.14", "status": "unaffected"}], "version": "7.0.0", "versionType": "git", "lessThanOrEqual": "7.0.13"}, {"status": "affected", "changes": [{"at": "7.2.8", "status": "unaffected"}], "version": "7.2.0", "versionType": "git", "lessThanOrEqual": "7.2.7"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Update the affected components to their respective fixed versions.", "supportingMedia": [{"type": "text/html", "value": "<p>Update the affected components to their respective fixed versions.</p>", "base64": false}]}], "references": [{"url": "https://support.zabbix.com/browse/ZBX-26988"}], "workarounds": [{"lang": "en", "value": "Make sure there are no Zabbix users without a user group.", "supportingMedia": [{"type": "text/html", "value": "<p>Make sure there are no Zabbix users without a user group.</p>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": ":"}]}], "configurations": [{"lang": "en", "value": "An attacker could retrieve a list of all host prototypes from API if they have access to a low privilege user account with no user roles assigned.", "supportingMedia": [{"type": "text/html", "value": "<p>An attacker could retrieve a list of all host prototypes from API if they have access to a low privilege user account with no user roles assigned.</p>", "base64": false}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2025-09-12T10:33:17.753Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27238", "state": "PUBLISHED", "dateUpdated": "2025-09-15T18:48:19.882Z", "dateReserved": "2025-02-20T11:40:38.480Z", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "datePublished": "2025-09-12T10:33:17.753Z", "assignerShortName": "Zabbix"}, "dataVersion": "5.1"}