CVE-2022-46768: File name information disclosure vulnerability in Zabbix Web Service Report Generation
First published: Wed Sep 21 2022(Updated: )
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
Credit: security@zabbix.com security@zabbix.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zabbix Web Service Report Generation | >=6.0.0<=6.0.11 | |
| Zabbix Web Service Report Generation | >=6.2.0<=6.2.5 | |
| Zabbix Zabbix-agent2 | <6.0.12 | |
| Zabbix Zabbix-agent2 | >=6.2.0<6.2.6 | |
| >=6.0.0<=6.0.11 | ||
| >=6.2.0<=6.2.5 | ||
| <6.0.12 | ||
| >=6.2.0<6.2.6 |
Remedy
To remediate this vulnerability, apply updates to the appropriate products or use the workaround
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this arbitrary file read vulnerability?
The vulnerability ID for this arbitrary file read vulnerability is CVE-2022-46768.
What is the affected software for this vulnerability?
The affected software for this vulnerability is Zabbix Web Service Report Generation and Zabbix Zabbix-agent2.
What is the severity rating of CVE-2022-46768?
The severity rating of CVE-2022-46768 is medium with a CVSS score of 5.9.
How can I fix the arbitrary file read vulnerability in Zabbix Web Service Report Generation?
To fix the arbitrary file read vulnerability in Zabbix Web Service Report Generation, upgrade to a version between 6.0.0 and 6.0.11.
How can I fix the arbitrary file read vulnerability in Zabbix Zabbix-agent2?
To fix the arbitrary file read vulnerability in Zabbix Zabbix-agent2, upgrade to a version between 6.2.0 and 6.2.5.
- collector/nvd-index
- agent/type
- agent/title
- agent/severity
- agent/weakness
- agent/references
- agent/remedy
- agent/first-publish-date
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/zabbix
- canonical/zabbix web service report generation
- version/zabbix web service report generation/6.0.0
- version/zabbix web service report generation/6.0.11
- version/zabbix web service report generation/6.2.0
- version/zabbix web service report generation/6.2.5
- canonical/zabbix zabbix-agent2
- version/zabbix zabbix-agent2/6.2.0