Arbitrary file deletion

2022-12-1507:15:00

PRIOn knowledge base

www.prio-n.com

zabbix

web service

vulnerability

file deletion

nvd

url parameters

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.2%

JSON

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.

CPENameOperatorVersion
web_service_report_generationge6.2.0
web_service_report_generationle6.2.5
web_service_report_generationge6.0.0
web_service_report_generationle6.0.11
zabbix-agent2ge6.2.0
zabbix-agent2lt6.2.6
zabbix-agent2lt6.0.12

Name	Operator	Version
web_service_report_generation	ge	6.2.0
web_service_report_generation	le	6.2.5
web_service_report_generation	ge	6.0.0
web_service_report_generation	le	6.0.11
zabbix-agent2	ge	6.2.0
zabbix-agent2	lt	6.2.6
zabbix-agent2	lt	6.0.12

References

support.zabbix.com/browse/ZBX-22087