CVE-2014-1685: Medium severity Zabbix Zabbix vulnerability
Published May 8, 2014
·Updated
The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors.
Affected Software
46 affected components
Zabbix Zabbix<=1.8.19
Zabbix Zabbix=1.8
Zabbix Zabbix=1.8.1
Zabbix Zabbix=1.8.2
Zabbix Zabbix=1.8.3-rc1
Zabbix Zabbix=1.8.3-rc2
Zabbix Zabbix=1.8.3-rc3
Zabbix Zabbix=1.8.15-rc1
Zabbix Zabbix=1.8.16
Zabbix Zabbix=1.8.18
Zabbix Zabbix=2.0.0
Zabbix Zabbix=2.0.0-rc1
Zabbix Zabbix=2.0.0-rc2
Zabbix Zabbix=2.0.0-rc3
Zabbix Zabbix=2.0.0-rc4
Zabbix Zabbix=2.0.0-rc5
Zabbix Zabbix=2.0.0-rc6
Zabbix Zabbix=2.0.1
Zabbix Zabbix=2.0.1-rc1
Zabbix Zabbix=2.0.1-rc2
Zabbix Zabbix=2.0.2
Zabbix Zabbix=2.0.2-rc1
Zabbix Zabbix=2.0.2-rc2
Zabbix Zabbix=2.0.3
Zabbix Zabbix=2.0.3-rc1
Zabbix Zabbix=2.0.3-rc2
Zabbix Zabbix=2.0.4
Zabbix Zabbix=2.0.4-rc1
Zabbix Zabbix=2.0.5
Zabbix Zabbix=2.0.5-rc1
Zabbix Zabbix=2.0.6
Zabbix Zabbix=2.0.6-rc1
Zabbix Zabbix=2.0.7-rc1
Zabbix Zabbix=2.0.8-rc1
Zabbix Zabbix=2.0.8-rc2
Zabbix Zabbix=2.0.9-rc1
Zabbix Zabbix=2.0.9-rc2
Zabbix Zabbix=2.0.10-rc1
Zabbix Zabbix=2.2.0
Zabbix Zabbix=2.2.0-rc1
Zabbix Zabbix=2.2.0-rc2
Zabbix Zabbix=2.2.1
Zabbix Zabbix=2.2.1
Zabbix Zabbix=2.2.1-rc1
Fedoraproject Fedora=19
Fedoraproject Fedora=20
Event History
May 8, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:29 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1685?
CVE-2014-1685 is classified as a medium severity vulnerability due to its impact on user permissions within Zabbix.
2
How do I fix CVE-2014-1685?
To fix CVE-2014-1685, update Zabbix to version 1.8.20rc2 or later, or 2.0.11rc2 or later, or 2.2.2rc1 or later.
3
Who is affected by CVE-2014-1685?
CVE-2014-1685 affects Zabbix versions prior to 1.8.20rc2, 2.0.11rc2, and 2.2.2rc1.
4
What impact does CVE-2014-1685 have?
CVE-2014-1685 enables remote Zabbix Admin users to modify the media settings of arbitrary users.
5
Is there a workaround for CVE-2014-1685?
There is no known workaround for CVE-2014-1685; updating to an unaffected version is the only solution.