Cyber Resilience

CVE-2019-17382

Access Control in Zabbix ≤ 4.4

Public PoCHigh EPSSAccess Control
Published
09 October 2019
Modified
21 November 2024
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.54 99th percentile
Risk Priority 92 floored blend · peak EPSS

Summary

CVE-2019-17382 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Zabbix Zabbix. Its CVSS base score is 9.1 (Critical).

Operationally, ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map)…

more

are accessible by other users and by an admin.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The vulnerability allows unauthenticated access to a web application endpoint, directly enabling exploitation of a public-facing application.
T1078 Valid Accounts Stealthconfidence: MEDIUM
Bypassing authentication to access the dashboard effectively allows use of the application without valid credentials.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-27240Same product: Zabbix Zabbix
CVE-2024-36464Same product: Zabbix Zabbix
CVE-2024-45699Same product: Zabbix Zabbix
CVE-2024-22120Same product: Zabbix Zabbix
CVE-2024-36469Same product: Zabbix Zabbix
CVE-2013-5743Same product: Zabbix Zabbix
CVE-2022-23131Same product: Zabbix Zabbix
CVE-2024-42329Same product: Zabbix Zabbix
CVE-2024-22116Same product: Zabbix Zabbix
CVE-2024-36468Same product: Zabbix Zabbix

Affected Assets

zabbix
zabbix
≤ 4.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-639

Per-request decision making makes it harder to bypass authorization using user-controlled keys without proper validation in the decision process.

addresses: CWE-639

Consistent enforcement of approved authorizations makes bypassing via user-controlled keys ineffective.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.

PR.IR-01 mostly match
prevents

Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect missing authorization checks but does not prevent the weakness in production.

prevents

Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.

prevents

Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.

prevents

Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.

mitigates

Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.

prevents

Secure development lifecycle includes authorization design but does not itself implement runtime access checks.

References