CVE-2022-46768: File name information disclosure vulnerability in Zabbix Web Service Report Generation
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/zabbixto a version that resolves this vulnerability.Fixed in 1:6.0.14+dfsg-1Fixed in 1:7.0.22+dfsg-1~deb13u1Fixed in 1:7.0.29+dfsg-2 - Upgrade
Upgrade
debian/zabbixto a version that resolves this vulnerability.Fixed in 1:6.0.13+dfsg-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this arbitrary file read vulnerability?
The vulnerability ID for this arbitrary file read vulnerability is CVE-2022-46768.
What is the affected software for this vulnerability?
The affected software for this vulnerability is Zabbix Web Service Report Generation and Zabbix Zabbix-agent2.
What is the severity rating of CVE-2022-46768?
The severity rating of CVE-2022-46768 is medium with a CVSS score of 5.9.
How can I fix the arbitrary file read vulnerability in Zabbix Web Service Report Generation?
To fix the arbitrary file read vulnerability in Zabbix Web Service Report Generation, upgrade to a version between 6.0.0 and 6.0.11.
How can I fix the arbitrary file read vulnerability in Zabbix Zabbix-agent2?
To fix the arbitrary file read vulnerability in Zabbix Zabbix-agent2, upgrade to a version between 6.2.0 and 6.2.5.