Loading...

XML

Word

Printable

CVE ID	CVE-2025-27231
CVSS score	4.3 (Medium)
CVSS vector	CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Affected components	Frontend
Summary	LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin
Description	The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.
Known attack vectors	A Zabbix Super Admin can set LDAP 'Host' to a rogue LDAP server to leak the 'Bind password' value.
Affected and fix version/s	Affected: `6.0.0` - `6.0.40` → Fixed: `6.0.41` Affected: `7.0.0` - `7.0.17` → Fixed: `7.0.18` Affected: `7.2.0` - `7.2.11` → Fixed: `7.2.12` Affected: `7.4.0` - `7.4.1` → Fixed: `7.4.2`
Mitigation	Update the affected components to their respective fixed versions.
Workarounds	-
Acknowledgements	Zabbix wants to thank Vladislav Volozhenko for finding and reporting this issue.