Skip to content
OpenAdvisories
High WID-SEC-2023-2638 5 CVEs

Zabbix: Mehrere Schwachstellen

Published Oct 11, 2023 · Updated Oct 3, 2024 · Revision 3 · de-DE

Vendor: Debian Vendor: Zabbix Product: Linux Product: Zabbix Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Zabbix ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Vulnerabilities 5

  • Critical 9.8
    CVE-2023-29453

    Agent 2 package are built with Go version affected by CVE-2023-24538

    Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Critical 9.6
    CVE-2023-32722

    Stack-buffer Overflow in library module zbxjson

    The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.

    Zabbix Zabbix zabbix Debian
  • Critical 9.1
    CVE-2023-32724

    JavaScript engine memory pointers are directly available for Zabbix users for modification

    Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • High 8.5
    CVE-2023-32723

    Inefficient permission check in class CControllerAuthenticationUpdate

    Request to LDAP is sent before user permissions are checked.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • High 7.6
    CVE-2023-32721

    Stored XSS in Maps element

    A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu

Revision history

  1. #3

    Neue Updates von Debian aufgenommen

  2. #2

    Neue Updates von Debian aufgenommen

  3. #1

    Initiale Fassung

References