CVE-2025-27231
- Source
- https://cve.org/CVERecord?id=CVE-2025-27231
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-27231.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-27231
- Downstream
- Published
- 2025-10-03T12:15:43.593Z
- Modified
- 2026-02-24T11:51:08.191327Z
- Severity
-
- 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.
- References
Affected packages
Git / github.com/zabbix/zabbix
Affected versions
6.*
6.0.0
6.0.1
6.0.10
6.0.10rc1
6.0.10rc2
6.0.11
6.0.11rc1
6.0.11rc2
6.0.12
6.0.12rc1
6.0.12rc2
6.0.13
6.0.13rc1
6.0.14
6.0.14rc1
6.0.14rc2
6.0.15
6.0.15rc1
6.0.15rc2
6.0.16
6.0.16rc1
6.0.17
6.0.17rc1
6.0.17rc2
6.0.18
6.0.18rc1
6.0.19
6.0.19rc1
6.0.1rc1
6.0.1rc2
6.0.1rc3
6.0.1rc4
6.0.2
6.0.20
6.0.20rc1
6.0.21
6.0.21rc1
6.0.22
6.0.22rc1
6.0.23
6.0.23rc1
6.0.25
6.0.25rc1
6.0.26
6.0.26rc1
6.0.27
6.0.27rc1
6.0.28
6.0.28rc1
6.0.29
6.0.29rc1
6.0.2rc1
6.0.3
6.0.30
6.0.30rc1
6.0.31
6.0.31rc1
6.0.32
6.0.32rc1
6.0.33
6.0.33rc1
6.0.34
6.0.34rc1
6.0.34rc2
6.0.35
6.0.35rc1
6.0.36
6.0.36rc1
6.0.37
6.0.37rc1
6.0.38
6.0.38rc1
6.0.39
6.0.39rc1
6.0.3rc1
6.0.4
6.0.40
6.0.40rc1
6.0.41
6.0.41rc1
6.0.42
6.0.42rc1
6.0.43
6.0.43rc1
6.0.44
6.0.44rc1
6.0.4rc1
6.0.5
6.0.5rc1
6.0.6
6.0.6rc1
6.0.7
6.0.7rc1
6.0.8
6.0.8rc1
6.0.8rc2
6.0.9
6.0.9rc1
6.0.9rc2
7.*
7.0.0
7.0.0alpha1
7.0.0alpha2
7.0.0alpha3
7.0.0alpha4
7.0.0alpha6
7.0.0alpha7
7.0.0alpha8
7.0.0alpha9
7.0.0beta1
7.0.0beta2
7.0.0beta3
7.0.0rc1
7.0.0rc2
7.0.0rc3
7.0.1
7.0.10
7.0.10rc1
7.0.11
7.0.11rc1
7.0.11rc2
7.0.12
7.0.12rc1
7.0.13
7.0.13rc1
7.0.14
7.0.14rc1
7.0.15
7.0.16
7.0.17
7.0.17rc1
7.0.17rc2
7.0.18rc1
7.0.18rc2
7.0.1rc1
7.0.1rc2
7.0.2
7.0.2rc1
7.0.2rc2
7.0.3
7.0.3rc1
7.0.4
7.0.4rc1
7.0.5
7.0.5rc1
7.0.6
7.0.6rc1
7.0.7
7.0.7rc1
7.0.8
7.0.8rc1
7.0.8rc2
7.0.9
7.0.9rc1
7.0.9rc2
7.4.0
7.4.1
7.4.1rc1
7.4.2rc1
7.4.2rc2
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-27231.json"
vanir_signatures
[
{
"source": "https://github.com/zabbix/zabbix/commit/7aa4e0782fe054d939732d2a5fd76454c2048b7b",
"signature_type": "Line",
"digest": {
"line_hashes": [
"144105446701650039828489585829017102713",
"275017799864624664550842864247300158979",
"149435833977353296812343392589762127376",
"92344100815198855778332463837559580297",
"99369761891446466830579167326090115898",
"36294681310094952528409578829069555347"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
},
"id": "CVE-2025-27231-65615939",
"signature_version": "v1"
},
{
"source": "https://github.com/zabbix/zabbix/commit/95bd11695a6b068f0ba4094a2b4158329e52f668",
"signature_type": "Line",
"digest": {
"line_hashes": [
"312614962226865881994625562760193464620",
"243857299040616033543277099011018562380",
"115047375198210276379139485775260446152",
"131652300589887294827463178296045152164",
"24451493220463986177515936334733341608",
"22616098638544051939022181165573400285"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
},
"id": "CVE-2025-27231-69436093",
"signature_version": "v1"
},
{
"source": "https://github.com/zabbix/zabbix/commit/8b4aa26fa68942f084dffe7b3ee92240716668e1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"325917972473406897390570734654822558102",
"32125530311294618412795821730601240268",
"214429688795761123913020144086386275717",
"14426496466396500284409442427146005275",
"180304062375870730933102632908758537579",
"177053738308140582317940139342598434556"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
},
"id": "CVE-2025-27231-7cec23a1",
"signature_version": "v1"
}
]