CVE-2019-15132: Debian Linux

Medium severity, CVSS 5.3. EPSS: 2% chance of exploitation in the next 30 days.

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.

Affected products

• Debian Debian Linux: version 9.0 only
• Zabbix Zabbix: up to and including 4.0.26; from 5.0.0, up to and including 5.0.5; from 5.2.0, up to and including 5.2.1; version 4.4.0 only

Published 2019-08-17. Last modified 2026-06-17.