PT-2025-37305

CVE-2025-27238

·

Published

2025-01-01

·

Updated

2025-10-11

Description by

CVSS 3.1
3.5
Low
MetricsAV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Zabbix (affected versions not specified)
Description: A flaw exists in the Zabbix API where the hostprototype.get method inappropriately lists all host prototypes to users lacking assigned user groups.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-285: Improper Authorization
CWE-284: Improper Access Control
Related identifiers
CVE-2025-27238
BDU:2025-11597
ALT-PU-2025-12643
ALT-PU-2025-12791
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com