35 results · Clear filters · Feed
-
Medium 5.3
SNMP trap injection in zabbix_trap_receiver.pl
The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.
-
Medium 6.9
Active agent heartbeat missing TLS check
Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, result…
-
Medium 5.1
Hidden host credentials inferable via multiselect.get filtering
Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it.
-
Medium 6.9
JavaScript preprocessing memory disclosure
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
-
Medium 6.0
Host PSK extraction in Zabbix API
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
-
Medium 6.8
Use-after-free read in script item/preprocessing HttpRequest body
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
-
Medium 5.3
Frontend DoS via the popup.testtriggerexpr action
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.
-
Medium 6.9
API and Frontend login lockout race condition
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.
-
Medium 5.1
Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.
-
Medium 6.1
Agent 2 Docker plugin arbitrary file read via Docker API injection
Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the…
-
Medium 5.1
Unauthorized host creation via configuration.import API by low-privilege user with write permissions
An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient …
-
Medium 6.0
Frontend DoS vulnerability due to asymmetric resource consumption
An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.
-
Medium 5.1
Insufficient permission check for the problem.view.refresh action
A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
-
Medium 4.3
LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin
The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.
-
Medium 5.7
Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.
-
Medium 6.0
DoS vulnerability due to uncontrolled resource exhaustion
Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompre…
-
Medium 4.4
Use after free vulnerability in browser.c
There was discovered a use after free bug in browser.c in the es_browser_get_variant function
-
Medium 6.5
The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access interna…
-
Medium 4.3
System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission
User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.
-
Medium 5.5
Stored XSS in graph items select form
The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.
-
Medium 4.6
Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.
-
Medium 6.8
Code execution vulnerability in icmpping
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
-
Medium 6.3
Insufficient validation of Action form input fields
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of m…
-
Medium 5.9
Duktape 2.6 bug crashes JavaScript putting too many values in valstack.
Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
-
Medium 5.7
Inefficient URL schema validation
URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.
-
Medium 5.4
Reflected XSS in several fields of graph form
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables…
-
Medium 5.4
Persistent XSS in the user form
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentio…
-
Medium 5.5CVE-2023-29452 EPSS 64%
Remove possibility to add html into Geomap attribution field
Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.
-
Medium 4.7
Denial of service caused by a bug in the JSON parser
Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.
-
Medium 5.9
Limited control of resource utilization in JS preprocessing
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative…
-
Medium 5.9CVE-2022-46768 EPSS 48%
File name information disclosure vulnerability in Zabbix Web Service Report Generation
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
-
Medium 5.3
X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitiv…
-
Medium 4.8
Reflected XSS in the backurl parameter of Zabbix Frontend
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.
-
Medium 4.6
Reflected XSS in action configuration window of Zabbix Frontend
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page b…
-
Medium 6.3
Stored XSS in host groups configuration window in Zabbix Frontend
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS …