PT-2019-7540 · Zabbix+3 · Zabbix+3

Oliveira Lima · Published 2014-09-21 · Updated 2022-06-15 · CVE-2016-10742

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zabbix versions 2.2 through 2.2.21rc1 Zabbix versions 3.0 through 3.0.13rc1 Zabbix versions 3.1.x through 3.2.10rc1 Zabbix versions 3.3.x through 3.4.4rc1

Description The issue allows for an open redirect via the request parameter. This can potentially be exploited by attackers to redirect users to malicious websites.

Recommendations For Zabbix versions 2.2 through 2.2.21rc1, update to version 2.2.21rc1 or later. For Zabbix versions 3.0 through 3.0.13rc1, update to version 3.0.13rc1 or later. For Zabbix versions 3.1.x through 3.2.10rc1, update to version 3.2.10rc1 or later. For Zabbix versions 3.3.x through 3.4.4rc1, update to version 3.4.4rc1 or later. As a temporary workaround, consider restricting access to the vulnerable parameter request until a patch is available.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2014-2165

ALT-PU-2017-2601

CVE-2016-10742

DLA-1708-1

DLA-2461-1

USN-4767-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Zabbix

References · 24

• 🔥 https://support.zabbix.com/browse/ZBX-10272 · Exploit
• https://ubuntu.com/security/CVE-2016-4338 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10742 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15132 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15803 · Vendor Advisory
• https://support.zabbix.com/browse/ZBX-13133 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10742 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4767-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2824 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10742 · Security Note
• https://osv.dev/vulnerability/USN-4767-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10134 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-10742 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10742 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10742 · Vendor Advisory