CVE-2019-17382
Critical · 9.1CVSS
9.1
EPSS
54.1%
Published
Oct 9, 2019
CISA due date
—
The record
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | zabbix | 0 | 1:4.0.4+dfsg-1+deb10u2 |
| Debian:11 | zabbix | 0 | 1:5.0.0+dfsg-1 |
| Debian:12 | zabbix | 0 | 1:5.0.0+dfsg-1 |
| Debian:13 | zabbix | 0 | 1:5.0.0+dfsg-1 |
| Ubuntu:20.04:LTS | zabbix | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | zabbix | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | zabbix | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | zabbix | 0 | No fix |
Related vulnerabilities
- CVE-2023-32726 The vulnerability is caused by improper check for check if RDLENGTH does not overflow the… Also affects zabbix
- CVE-2023-29456 URL validation scheme receives input from a user and then parses it to identify its… Also affects zabbix
- CVE-2023-29457 Reflected XSS attacks, occur when a malicious script is reflected off a web application… Also affects zabbix
- CVE-2023-29455 Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious… Also affects zabbix
- CVE-2023-29454 Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first… Also affects zabbix
- CVE-2022-43515 Zabbix Frontend provides a feature that allows admins to maintain the installation and… Also affects zabbix
- CVE-2022-24917 An authenticated user can create a link with reflected Javascript code inside it for… Also affects zabbix
- CVE-2022-24919 An authenticated user can create a link with reflected Javascript code inside it for… Also affects zabbix