CVE-2022-46768: File name information disclosure vulnerability in Zabbix Web Service Report Generation
Published Sep 21, 2022
·Updated
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
Affected Software
4 affected components
Zabbix Web Service Report Generation>=6.0.0<=6.0.11
Zabbix Web Service Report Generation>=6.2.0<=6.2.5
Zabbix zabbix-agent2<6.0.12
Zabbix zabbix-agent2>=6.2.0<6.2.6
Remediation
Patch Available
Information
To remediate this vulnerability, apply updates to the appropriate products or use the workaround
Event History
Dec 15, 2022
CVE Published
07:15 AM
Data Sourced
via NVD·07:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Dec 19, 2022
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this arbitrary file read vulnerability?
The vulnerability ID for this arbitrary file read vulnerability is CVE-2022-46768.
2
What is the affected software for this vulnerability?
The affected software for this vulnerability is Zabbix Web Service Report Generation and Zabbix Zabbix-agent2.
3
What is the severity rating of CVE-2022-46768?
The severity rating of CVE-2022-46768 is medium with a CVSS score of 5.9.
4
How can I fix the arbitrary file read vulnerability in Zabbix Web Service Report Generation?
To fix the arbitrary file read vulnerability in Zabbix Web Service Report Generation, upgrade to a version between 6.0.0 and 6.0.11.
5
How can I fix the arbitrary file read vulnerability in Zabbix Zabbix-agent2?
To fix the arbitrary file read vulnerability in Zabbix Zabbix-agent2, upgrade to a version between 6.2.0 and 6.2.5.