CVE-2012-3435: SQL Injection
Published Aug 15, 2012
·Updated
SQL injection vulnerability in frontends/php/popupbitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter.
Affected Software
70 affected components
Zabbix Zabbix<=1.8.15
Zabbix Zabbix=1.1
Zabbix Zabbix=1.1-beta10
Zabbix Zabbix=1.1-beta11
Zabbix Zabbix=1.1-beta12
Zabbix Zabbix=1.1-beta2
Zabbix Zabbix=1.1-beta3
Zabbix Zabbix=1.1-beta4
Zabbix Zabbix=1.1-beta5
Zabbix Zabbix=1.1-beta6
Zabbix Zabbix=1.1-beta7
Zabbix Zabbix=1.1-beta8
Zabbix Zabbix=1.1-beta9
Zabbix Zabbix=1.1.1
Zabbix Zabbix=1.1.2
Zabbix Zabbix=1.1.3
Zabbix Zabbix=1.1.4
Zabbix Zabbix=1.1.5
Zabbix Zabbix=1.1.6
Zabbix Zabbix=1.1.7
Zabbix Zabbix=1.3-beta
Zabbix Zabbix=1.3.1-beta
Zabbix Zabbix=1.3.2-beta
Zabbix Zabbix=1.3.3-beta
Zabbix Zabbix=1.3.4-beta
Zabbix Zabbix=1.3.5-beta
Zabbix Zabbix=1.3.6-beta
Zabbix Zabbix=1.3.7-beta
Zabbix Zabbix=1.3.8-beta
Zabbix Zabbix=1.4.2
Zabbix Zabbix=1.4.3
Zabbix Zabbix=1.4.4
Zabbix Zabbix=1.4.5
Zabbix Zabbix=1.4.6
Zabbix Zabbix=1.5-beta
Zabbix Zabbix=1.5.1-beta
Zabbix Zabbix=1.5.2-beta
Zabbix Zabbix=1.5.3-beta
Zabbix Zabbix=1.5.4-beta
Zabbix Zabbix=1.6
Zabbix Zabbix=1.6.1
Zabbix Zabbix=1.6.2
Zabbix Zabbix=1.6.3
Zabbix Zabbix=1.6.4
Zabbix Zabbix=1.6.5
Zabbix Zabbix=1.6.6
Zabbix Zabbix=1.6.7
Zabbix Zabbix=1.6.8
Zabbix Zabbix=1.6.9
Zabbix Zabbix=1.7
Zabbix Zabbix=1.7.1
Zabbix Zabbix=1.7.2
Zabbix Zabbix=1.7.3
Zabbix Zabbix=1.7.4
Zabbix Zabbix=1.8
Zabbix Zabbix=1.8.1
Zabbix Zabbix=1.8.2
Zabbix Zabbix=1.8.3-rc1
Zabbix Zabbix=1.8.3-rc2
Zabbix Zabbix=1.8.3-rc3
Zabbix Zabbix=2.0.0
Zabbix Zabbix=2.0.0-rc1
Zabbix Zabbix=2.0.0-rc2
Zabbix Zabbix=2.0.0-rc3
Zabbix Zabbix=2.0.0-rc4
Zabbix Zabbix=2.0.0-rc5
Zabbix Zabbix=2.0.0-rc6
Zabbix Zabbix=2.0.1
Zabbix Zabbix=2.0.1-rc1
Zabbix Zabbix=2.0.1-rc2
Remediation
Event History
Aug 15, 2012
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-3435?
CVE-2012-3435 is classified as a high-severity SQL injection vulnerability.
2
How do I fix CVE-2012-3435?
To fix CVE-2012-3435, update Zabbix to version 2.0.2rc1 or later.
3
What systems are affected by CVE-2012-3435?
CVE-2012-3435 affects Zabbix versions 1.8.15rc1 and earlier, as well as 2.x prior to 2.0.2rc1.
4
What type of attack is enabled by CVE-2012-3435?
CVE-2012-3435 allows remote attackers to execute arbitrary SQL commands via the itemid parameter.
5
Is CVE-2012-3435 a common vulnerability?
CVE-2012-3435 is a known vulnerability that has been documented and fixed in subsequent patches.