CVE-2011-3264: Infoleak
Published Aug 19, 2011
·Updated
Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message.
Affected Software
67 affected components
Zabbix Zabbix=1.6.1
Zabbix Zabbix=1.1-beta2
Zabbix Zabbix=1.1.2
Zabbix Zabbix=1.8.4-rc3
Zabbix Zabbix=1.7.4
Zabbix Zabbix=1.5.3-beta
Zabbix Zabbix=1.1.4
Zabbix Zabbix=1.1.6
Zabbix Zabbix=1.8.3-rc1
Zabbix Zabbix=1.4.3
Zabbix Zabbix=1.8.4-rc1
Zabbix Zabbix=1.6.5
Zabbix Zabbix=1.4.6
Zabbix Zabbix=1.6.8
Zabbix Zabbix=1.1-beta4
Zabbix Zabbix=1.7.1
Zabbix Zabbix=1.4.4
Zabbix Zabbix=1.5.1-beta
Zabbix Zabbix=1.1
Zabbix Zabbix=1.3.7-beta
Zabbix Zabbix=1.8.4-rc4
Zabbix Zabbix=1.7.2
Zabbix Zabbix=1.8
Zabbix Zabbix=1.8.3-rc2
Zabbix Zabbix=1.6.3
Zabbix Zabbix=1.1-beta3
Zabbix Zabbix=1.3.1-beta
Zabbix Zabbix=1.3.2-beta
Zabbix Zabbix=1.6.2
Zabbix Zabbix=1.8.3-rc3
Zabbix Zabbix=1.7
Zabbix Zabbix=1.3.5-beta
Zabbix Zabbix=1.1.7
Zabbix Zabbix=1.6
Zabbix Zabbix=1.6.7
Zabbix Zabbix=1.6.4
Zabbix Zabbix=1.1-beta9
Zabbix Zabbix=1.1-beta10
Zabbix Zabbix=1.3.8-beta
Zabbix Zabbix=1.7.3
Zabbix Zabbix=1.1-beta6
Zabbix Zabbix=1.8.2
Zabbix Zabbix=1.3.6-beta
Zabbix Zabbix=1.5.4-beta
Zabbix Zabbix=1.1.1
Zabbix Zabbix=1.1-beta8
Zabbix Zabbix=1.8.3
Zabbix Zabbix=1.1-beta11
Zabbix Zabbix=1.1-beta7
Zabbix Zabbix=1.1.3
Zabbix Zabbix=1.8.1
Zabbix Zabbix=1.6.6
Zabbix Zabbix=1.6.9
Zabbix Zabbix=1.4.5
Zabbix Zabbix<=1.8.5
Zabbix Zabbix=1.3.4-beta
Zabbix Zabbix=1.1-beta5
Zabbix Zabbix=1.8.4
Zabbix Zabbix=1.5-beta
Zabbix Zabbix=1.4.2
Zabbix Zabbix=1.1-beta12
Zabbix Zabbix=1.8.4-rc2
Zabbix Zabbix=1.1.5
Zabbix Zabbix=1.5.2-beta
Zabbix Zabbix=1.8.5-rc1
Zabbix Zabbix=1.3.3-beta
Zabbix Zabbix=1.3-beta
Remediation
Patch Available
Event History
Aug 19, 2011
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-3264?
The severity of CVE-2011-3264 is classified as medium.
2
How do I fix CVE-2011-3264?
To fix CVE-2011-3264, upgrade to Zabbix version 1.8.6 or later.
3
What type of vulnerability is CVE-2011-3264?
CVE-2011-3264 is an information disclosure vulnerability.
4
Which versions of Zabbix are affected by CVE-2011-3264?
Versions of Zabbix prior to 1.8.6, including 1.6.1, 1.1-beta2, and others, are affected by CVE-2011-3264.
5
What happens if CVE-2011-3264 is exploited?
If CVE-2011-3264 is exploited, attackers may gain access to sensitive information such as the installation path.