关键漏洞信息 CVE ID: CVE-2025-49643 CVSS Score: 6.0 (Medium) CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Components: Frontend Summary: Frontend DoS vulnerability due to asymmetric resource consumption Description: An authenticated Zabbix user (including Guest) can cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service. Known Attack Vectors: An authenticated user sending crafted HTTP requests to Zabbix Frontend. Affected and Fix Versions: - Affected: 6.0.0 - 6.0.41 → Fixed: 6.0.42 - Affected: 7.0.0 - 7.0.18 → Fixed: 7.0.19 - Affected: 7.2.0 - 7.2.12 → Fixed: 7.2.13 - Affected: 7.4.0 - 7.4.2 → Fixed: 7.4.3 Mitigation: Update the affected components to their respective fixed versions. Acknowledgements: Zabbix wants to thank Pamparau Sebastian (sebiice) for submitting this report on the HackerOne bug bounty platform.