Description
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zabbix | Web Service Report Generation | 6.0.0-6.0.11, 6.2.0-6.2.5 | — |
| Zabbix | Zabbix agent 2 (MSI packages) | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zabbix | 1:6.0.13+dfsg-1 | — |
| Debian 13 | zabbix | 1:6.0.13+dfsg-1 | — |
| Debian 12 | zabbix | 1:6.0.13+dfsg-1 | — |
Advisories 1
- WID-SEC-2022-2337 Zabbix: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Dec 14, 2022