PT-2014-4290 · Zabbix+1 · Zabbix+1

Vitaly Shupak · Published 2014-02-13 · Updated 2014-05-09 · CVE-2014-1682

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zabbix versions prior to 1.8.20rc1 Zabbix versions 2.0.x prior to 2.0.11rc1 Zabbix versions 2.2.x prior to 2.2.2rc1

Description The issue allows remote authenticated users to spoof arbitrary users via the user name in a "user.login" request.

Recommendations For versions prior to 1.8.20rc1, update to version 1.8.20rc1 or later. For versions 2.0.x prior to 2.0.11rc1, update to version 2.0.11rc1 or later. For versions 2.2.x prior to 2.2.2rc1, update to version 2.2.2rc1 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2014-1190

CVE-2014-1682

MGASA-2014-0095

Affected Products

Alt Linux

Zabbix

References · 19

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1685 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132376.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-1682 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0095 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1682 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1682 · Security Note
• https://advisories.mageia.org/MGASA-2014-0095.html · Security Note
• https://osv.dev/vulnerability/CVE-2014-1682 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132377.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-1190 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1682 · Security Note
• https://support.zabbix.com/browse/ZBX-7693 · Note
• http://securityfocus.com/bid/65402 · Note
• http://zabbix.com/rn2.0.11.php · Note
• https://bugs.mageia.org/show_bug.cgi?id=12574 · Note