ALT-PU-2021-2668-1

BDU:2022-00879

HIGH7.2

Уязвимость универсальной системы мониторинга Zabbix , связанная с ошибками авторизации, позволяющая нарушителю выполнить произвольный код с root-привилегиями

Published: 2022-02-22Modified: 2025-03-05

CVSS 3.xHIGH 7.2

CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0MEDIUM 6.5

CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:P

References

CVE-2021-46088

BDU:2023-01711

MEDIUM5.4

Уязвимость универсальной системы мониторинга Zabbix, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю оказать воздействие на целостность данных

Published: 2023-03-28Modified: 2025-03-05

CVSS 3.xMEDIUM 5.4

CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS 2.0MEDIUM 4.9

CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:P/A:N

References

CVE-2022-35229

BDU:2023-01712

MEDIUM5.4

Уязвимость универсальной системы мониторинга Zabbix, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю оказать воздействие на целостность данных

Published: 2023-03-28Modified: 2025-03-05

CVSS 3.xMEDIUM 5.4

CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS 2.0MEDIUM 4.9

CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:P/A:N

References

CVE-2022-35230

CVE-2021-46088

HIGH7.2

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.

Published: 2022-01-27Modified: 2024-11-21

CVSS 2.0MEDIUM 6.5

CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS 3.xHIGH 7.2

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

CVE-2022-35229

MEDIUM5.4

An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

Published: 2022-07-06Modified: 2025-11-03

CVSS 2.0LOW 3.5

CVSS:2.0/AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS 3.xMEDIUM 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

CVE-2022-35230

MEDIUM5.4

An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

Published: 2022-07-06Modified: 2025-11-03

CVSS 2.0LOW 3.5

CVSS:2.0/AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS 3.xMEDIUM 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

Package update zabbix in branch p10

Closed issues (6)

Уязвимость универсальной системы мониторинга Zabbix , связанная с ошибками авторизации, позволяющая нарушителю выполнить произвольный код с root-привилегиями

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.

An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.