PT-2022-6820 · Zabbix+1 · Zabbix+1

Alexey Mitrofanov · Published 2022-09-26 · Updated 2023-08-23 · CVE-2022-46768

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zabbix (affected versions not specified)

Description A security issue exists in Zabbix Web Service Report Generation, which listens on port 10053. The service lacks proper validation for URL parameters before reading files, allowing for arbitrary file read. This could enable a remote attacker to access confidential data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-04815

CVE-2022-46768

ZDI-23-1168

Affected Products

Astra Linux

Zabbix

References · 11

• https://security-tracker.debian.org/tracker/CVE-2022-46768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46768 · Security Note
• https://support.zabbix.com/browse/ZBX-22087 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1168 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04815 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46768 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-46768 · Vendor Advisory
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.11 · Note
• https://t.me/cvenotify/39927 · Telegram Post
• https://t.me/cvenotify/39934 · Telegram Post