Medium WID-SEC-2022-2337 1 CVE

Zabbix: Schwachstelle ermöglicht Offenlegung von Informationen

Published Dec 14, 2022 · Updated Dec 14, 2022 · de-DE

Vendor: Zabbix Product: Zabbix < 6.4.0beta5 Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Zabbix ausnutzen, um Informationen offenzulegen.

Product

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Vulnerabilities 1

Medium 5.9

CVE-2022-46768 EPSS 48%

File name information disclosure vulnerability in Zabbix Web Service Report Generation

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.

Zabbix Zabbix agent 2 (MSI packages) Web Service Report Generation zabbix Debian

Dec 19, 2022

Revision history

2022-12-14 #1
Initiale Fassung

References

ZABBIX BUGS AND ISSUES vom 2022-12-14
https://support.zabbix.com/browse/ZBX-22087