CVE-2019-15132

Name	CVE-2019-15132
Description	Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2631-1, DLA-3390-1
Debian Bugs	935027

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
zabbix (PTS)	bullseye	1:5.0.8+dfsg-1	fixed
	bullseye (security)	1:5.0.44+dfsg-1+deb11u1	fixed
	bookworm	1:6.0.14+dfsg-1	fixed
	trixie	1:7.0.5+dfsg-1	fixed
	sid	1:7.0.6+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
zabbix	source	stretch	1:3.0.32+dfsg-0+deb9u1	DLA-2631-1
zabbix	source	buster	1:4.0.4+dfsg-1+deb10u1	DLA-3390-1
zabbix	source	(unstable)	1:5.0.7+dfsg-1		935027

Notes

[jessie] - zabbix <postponed> (Minor issue)
https://support.zabbix.com/browse/ZBX-16532
https://support.zabbix.com/browse/ZBX-5842
https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/b5a110e4d1c21d865cd03e3ef8dbc6f37221b60f (4.0.27rc1)