CVE-2024-36467 Authentication privilege escalation via user groups due to missing authorization checks
Authenticated users can escalate privileges to administrator by adding themselves to restricted groups via the user update API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36467?
CVE-2024-36467 is a high-severity missing authorization vulnerability in Zabbix Zabbix, published on 27 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabled or having restricted GUI access.
Weakness: CWE-285
Which versions are affected by CVE-2024-36467?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2024-36467?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-36467 being exploited?
There is no known exploitation of CVE-2024-36467 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2024-36467, GHSA-xwvj-c6cj-6xgw, UBUNTU-CVE-2024-36467.