CVE-2022-46768

The record

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.

Affected packages

Related vulnerabilities

• CVE-2024-36465 A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability… Also affects zabbix
• CVE-2024-36466 A bug in the code allows an attacker to sign a forged zbx_session cookie, which then… Also affects zabbix
• CVE-2024-36464 When exporting media types, the password is exported in the YAML in plain text. Also affects zabbix
• CVE-2024-42330 The HttpRequest object allows to get the HTTP headers from the server's response after… Also affects zabbix
• CVE-2024-42333 The researcher is showing that it is possible to leak a small amount of Zabbix Server… Also affects zabbix
• CVE-2024-42332 The researcher is showing that due to the way the SNMP trap log is parsed, an attacker… Also affects zabbix
• CVE-2024-42331 In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap… Also affects zabbix
• CVE-2024-42327 A non-admin user account on the Zabbix frontend with the default User role, or with any… Also affects zabbix