CVE-2014-1682: Medium severity Zabbix Zabbix vulnerability
Published May 8, 2014
·Updated
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.
Affected Software
46 affected components
Zabbix Zabbix<=1.8.19
Zabbix Zabbix=1.8
Zabbix Zabbix=1.8.1
Zabbix Zabbix=1.8.2
Zabbix Zabbix=1.8.3-rc1
Zabbix Zabbix=1.8.3-rc2
Zabbix Zabbix=1.8.3-rc3
Zabbix Zabbix=1.8.15-rc1
Zabbix Zabbix=1.8.16
Zabbix Zabbix=1.8.18
Zabbix Zabbix=2.0.0
Zabbix Zabbix=2.0.0-rc1
Zabbix Zabbix=2.0.0-rc2
Zabbix Zabbix=2.0.0-rc3
Zabbix Zabbix=2.0.0-rc4
Zabbix Zabbix=2.0.0-rc5
Zabbix Zabbix=2.0.0-rc6
Zabbix Zabbix=2.0.1
Zabbix Zabbix=2.0.1-rc1
Zabbix Zabbix=2.0.1-rc2
Zabbix Zabbix=2.0.2
Zabbix Zabbix=2.0.2-rc1
Zabbix Zabbix=2.0.2-rc2
Zabbix Zabbix=2.0.3
Zabbix Zabbix=2.0.3-rc1
Zabbix Zabbix=2.0.3-rc2
Zabbix Zabbix=2.0.4
Zabbix Zabbix=2.0.4-rc1
Zabbix Zabbix=2.0.5
Zabbix Zabbix=2.0.5-rc1
Zabbix Zabbix=2.0.6
Zabbix Zabbix=2.0.6-rc1
Zabbix Zabbix=2.0.7-rc1
Zabbix Zabbix=2.0.8-rc1
Zabbix Zabbix=2.0.8-rc2
Zabbix Zabbix=2.0.9-rc1
Zabbix Zabbix=2.0.9-rc2
Zabbix Zabbix=2.0.10-rc1
Zabbix Zabbix=2.2.0
Zabbix Zabbix=2.2.0-rc1
Zabbix Zabbix=2.2.0-rc2
Zabbix Zabbix=2.2.1
Zabbix Zabbix=2.2.1
Zabbix Zabbix=2.2.1-rc1
Fedoraproject Fedora=19
Fedoraproject Fedora=20
Event History
May 8, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1682?
CVE-2014-1682 is classified as a medium severity vulnerability.
2
How do I fix CVE-2014-1682?
To fix CVE-2014-1682, upgrade Zabbix to version 1.8.20rc1, 2.0.11rc1, or 2.2.2rc1 or later.
3
Who is affected by CVE-2014-1682?
Remote authenticated users of Zabbix versions prior to 1.8.20rc1, 2.0.11rc1, and 2.2.2rc1 are affected by CVE-2014-1682.
4
What type of attack is possible with CVE-2014-1682?
CVE-2014-1682 allows remote authenticated users to spoof arbitrary users through the user name in a user.login request.
5
Can I exploit CVE-2014-1682 without authentication?
No, exploitation of CVE-2014-1682 requires prior authentication as a user.