In Zabbix before 4.0.28rc1, 5.x before 5.0.8rc1, 5.1.x and 5.2.x before 5.2.4rc1, and 5.3.x and 5.4.x before 5.4.0alpha1, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method.
Created zabbix tracking bugs for this issue:
Affects: fedora-all [bug 1934826]
Created zabbix30 tracking bugs for this issue:
Affects: epel-7 [bug 1934827]
Created zabbix40 tracking bugs for this issue:
Affects: epel-all [bug 1934828]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.