Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-08298
HistoryJan 17, 2022 - 12:00 a.m.

Zabbix Sia Zabbix has an unspecified vulnerability

2022-01-1700:00:00
China National Vulnerability Database
www.cnvd.org.cn
11

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

Zabbix Sia Zabbix is an open source monitoring system from the Latvian company Zabbix SIA (Zabbix Sia). The system supports network monitoring, server monitoring, cloud monitoring, and application monitoring, etc. A security vulnerability exists in Zabbix Frontend, which stems from the fact that with SAML SSO authentication enabled (not the default), a malicious actor could modify session data because user logins stored in the session are not authenticated. An attacker could exploit the vulnerability to elevate privileges and gain administrator access to the Zabbix Frontend.

CPENameOperatorVersion
Zabbix Zabbix>=5.4.0,le5.4.8

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P