Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.
{ "ubuntu_priority": "low", "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "binaries": [ { "binary_name": "zabbix-agent", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-agent-dbgsym", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-frontend-php", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-java-gateway", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-proxy-mysql", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-proxy-mysql-dbgsym", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-proxy-pgsql", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-proxy-pgsql-dbgsym", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-proxy-sqlite3", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-proxy-sqlite3-dbgsym", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-server-mysql", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-server-mysql-dbgsym", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-server-pgsql", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" }, { "binary_name": "zabbix-server-pgsql-dbgsym", "binary_version": "1:2.2.2+dfsg-1ubuntu1+esm4" } ] }
{ "ubuntu_priority": "low", "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "zabbix-agent", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-agent-dbgsym", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-frontend-php", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-java-gateway", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-proxy-mysql", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-proxy-mysql-dbgsym", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-proxy-pgsql", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-proxy-pgsql-dbgsym", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-proxy-sqlite3", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-proxy-sqlite3-dbgsym", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-server-mysql", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-server-mysql-dbgsym", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-server-pgsql", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" }, { "binary_name": "zabbix-server-pgsql-dbgsym", "binary_version": "1:2.4.7+dfsg-2ubuntu2.1+esm3" } ] }
{ "ubuntu_priority": "low", "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "zabbix-agent", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-agent-dbgsym", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-frontend-php", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-java-gateway", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-proxy-mysql", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-proxy-mysql-dbgsym", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-proxy-pgsql", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-proxy-pgsql-dbgsym", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-proxy-sqlite3", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-proxy-sqlite3-dbgsym", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-server-mysql", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-server-mysql-dbgsym", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-server-pgsql", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" }, { "binary_name": "zabbix-server-pgsql-dbgsym", "binary_version": "1:3.0.12+dfsg-1ubuntu0.1~esm3" } ] }
{ "ubuntu_priority": "low", "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_name": "zabbix-agent", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-agent-dbgsym", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-frontend-php", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-java-gateway", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-proxy-mysql", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-proxy-mysql-dbgsym", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-proxy-pgsql", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-proxy-pgsql-dbgsym", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-proxy-sqlite3", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-proxy-sqlite3-dbgsym", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-server-mysql", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-server-mysql-dbgsym", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-server-pgsql", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" }, { "binary_name": "zabbix-server-pgsql-dbgsym", "binary_version": "1:4.0.17+dfsg-1ubuntu0.1~esm1" } ] }
{ "ubuntu_priority": "low", "availability": "No subscription required", "binaries": [ { "binary_name": "zabbix-agent", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-agent-dbgsym", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-agent2", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-agent2-dbgsym", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-frontend-php", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-java-gateway", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-proxy-mysql", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-proxy-mysql-dbgsym", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-proxy-pgsql", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-proxy-pgsql-dbgsym", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-proxy-sqlite3", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-proxy-sqlite3-dbgsym", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-server-mysql", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-server-mysql-dbgsym", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-server-pgsql", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-server-pgsql-dbgsym", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-web-service", "binary_version": "1:6.0.29+dfsg-1" }, { "binary_name": "zabbix-web-service-dbgsym", "binary_version": "1:6.0.29+dfsg-1" } ] }