medium4.9
CVE-2025-27231
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server.
Impact
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zabbix | Zabbix | from 6.0.0 before 6.0.41 from 7.0.0 before 7.0.18 from 7.2.0 before 7.2.12 from 7.4.0 before 7.4.2 |