Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Zabbix ausnutzen, um einen Denial of Service Angriff durchzuführen und um Informationen offenzulegen.
Product
Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.
Vulnerabilities 2
-
High 8.5
Unauthorized limited filesystem access from preprocessing
JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
-
Medium 5.9
Limited control of resource utilization in JS preprocessing
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative…
Revision history
-
#3
Neue Updates von Debian aufgenommen
-
#2
Neue Updates von SUSE aufgenommen
-
#1
Initiale Fassung
References
-
GitHub Security Advisory vom 2023-07-12
https://github.com/advisories/GHSA-7q7m-r84j-6pm2
-
GitHub Security Advisory vom 2023-07-12
https://github.com/advisories/GHSA-hfrc-jq43-4m6c
-
SUSE Security Update SUSE-SU-2023:3029-1 vom 2023-07-31
https://lists.suse.com/pipermail/sle-security-updates/2023-July/015708.html
-
Debian Security Advisory DLA-3909 vom 2024-10-03
https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html