Zabbix 7.0.x < 7.0.14 / 7.2.x < 7.2.8 Information Disclosure (ZBX-26988)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(304675);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/06");

  script_cve_id("CVE-2025-27238");

  script_name(english:"Zabbix 7.0.x < 7.0.14 / 7.2.x < 7.2.8 Information Disclosure (ZBX-26988)");

  script_set_attribute(attribute:"synopsis", value:
"A monitoring application installed on the remote host is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Zabbix Server installed on the remote host is affected by a vulnerability. Due to a bug in Zabbix API,
the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  script_set_attribute(attribute:"see_also", value:"https://support.zabbix.com/browse/ZBX-26988");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Zabbix version 7.0.14, 7.2.8 or later.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-27238");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:zabbix:zabbix_server");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("zabbix_server_nix_installed.nbin");
  script_require_keys("installed_sw/Zabbix Server");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Zabbix Server', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'7.0.0', 'fixed_version':'7.0.14'},
        {'min_version':'7.2.0', 'fixed_version':'7.2.8'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_NOTE);
vdf::handle_check_and_report_errors(vdf_result:result);