Medium severity5.3NVD Advisory· Published Aug 17, 2019· Updated Jun 17, 2026

CVE-2019-15132

Description

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zabbix/Zabbix3 versions
cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*range: <=4.0.26
- cpe:2.3:a:zabbix:zabbix:4.4.0:alpha1:*:*:*:*:*:*
- (no CPE)range: <=4.4.0alpha1
Debian/linux
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Zabbix/Zabbixdescription

Patches

Vulnerability mechanics

References

lists.debian.org/debian-lts-announce/2021/04/msg00018.htmlnvdMailing ListThird Party Advisory
support.zabbix.com/browse/ZBX-16532nvdVendor Advisory
lists.debian.org/debian-lts-announce/2023/04/msg00013.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000