CVE-2009-4499: SQL Injection
Published Dec 31, 2009
·Updated
SQL injection vulnerability in the gethistorylastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the sendhistorylastid function in zabbixserver/trapper/nodehistory.c.
Affected Software
10 affected components
Zabbix Zabbix=1.1.2
Zabbix Zabbix=1.1.4
Zabbix Zabbix=1.4.3
Zabbix Zabbix<=1.6.7
Zabbix Zabbix=1.4.6
Zabbix Zabbix=1.4.4
Zabbix Zabbix=1.1.3
Zabbix Zabbix=1.6.6
Zabbix Zabbix=1.4.2
Zabbix Zabbix=1.1.5
Event History
Dec 31, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-4499?
CVE-2009-4499 is considered to have high severity due to its potential for remote exploitation.
2
How do I fix CVE-2009-4499?
To fix CVE-2009-4499, upgrade your Zabbix Server to version 1.6.8 or later.
3
Which versions of Zabbix are affected by CVE-2009-4499?
CVE-2009-4499 affects all Zabbix versions prior to 1.6.8.
4
What type of vulnerability is CVE-2009-4499?
CVE-2009-4499 is an SQL injection vulnerability that allows execution of arbitrary SQL commands.
5
Can CVE-2009-4499 be exploited remotely?
Yes, CVE-2009-4499 can be exploited remotely by attackers through crafted requests.