Zabbix API Excessive Information Disclosure Vulnerability

A vulnerability exists in the Zabbix API in versions 5.0.0 through 5.0.45, 6.0.0 through 6.0.37, 7.0.0 through 7.0.8, and 7.2.0 through 7.2.2. The issue arises in the 'user.get' method, which returns all users sharing a common group with the calling user. This response includes sensitive information such as media details and login attempt records. The vulnerability is categorized under improper authorization, allowing authenticated Zabbix API users with low privileges to access excessive user information.

Impact

This vulnerability could lead to unauthorized information disclosure, allowing users to access sensitive data about other users in the same group, including media information and login attempt details.

Remediation

Users can upgrade to Zabbix versions 5.0.46rc1, 6.0.38rc1, 7.0.9rc1, or 7.2.3rc1 to address this vulnerability.