CVE-2013-1364 Auth bypass in n/a
Remote attackers can bypass authentication in Zabbix by overriding LDAP configuration via the login function, potentially gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1364?
CVE-2013-1364 is a medium-severity authentication bypass vulnerability in Zabbix Zabbix, published on 14 Dec 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.
Weakness: CWE-287
Which versions are affected by CVE-2013-1364?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2013-1364?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2013-1364 being exploited?
There is no known exploitation of CVE-2013-1364 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2013-1364, GHSA-vq34-c5hg-7r26.