PT-2014-1995 · Zabbix+3 · Zabbix+3

Pnig0S · Published 2014-06-14 · Updated 2022-06-15 · CVE-2014-3005

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zabbix versions 1.8.x through 1.8.20 Zabbix versions 2.0.x through 2.0.12 Zabbix versions 2.2.x through 2.2.4 Zabbix versions 2.3.x through 2.3.1

Description The issue allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request. This is due to an XML external entity (XXE) vulnerability. The vulnerability can be exploited by sending a specially formed XML request, allowing an attacker to read arbitrary files or potentially execute arbitrary code.

Recommendations For Zabbix versions 1.8.x through 1.8.20, update to version 1.8.21rc1 or later. For Zabbix versions 2.0.x through 2.0.12, update to version 2.0.13rc1 or later. For Zabbix versions 2.2.x through 2.2.4, update to version 2.2.5rc1 or later. For Zabbix versions 2.3.x through 2.3.1, update to version 2.3.2 or later.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

ALT-PU-2014-1941

BDU:2018-00371

CVE-2014-3005

MGASA-2014-0433

USN-4767-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Zabbix

References · 58

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/zabbix_toggleids_sqli.rb · Exploit
• 🔥 https://github.com/nixawk/labs/tree/master/CVE-2016-4338 · Exploit
• 🔥 https://github.com/listenquiet/cve-2017-2824-reverse-shell · Exploit
• 🔥 https://support.zabbix.com/browse/ZBX-8151 · Exploit
• 🔥 https://web.archive.org/web/20140622034155/http://pnigos.com:80/?p=273 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2825 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02341 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3005 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0433 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10742 · Security Note
• https://ubuntu.com/security/CVE-2016-4338 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10742 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.html · Vendor Advisory