File name information disclosure vulnerability in Zabbix Web Service Report Generation
CVE-2022-46768

5.9MEDIUM

Key Information:

Vendor: Zabbix
Status: Web Service Report Generation; Zabbix Agent 2 (msi Packages)
Vendor: CVE Published:; 15 December 2022

What is CVE-2022-46768?

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.

Affected Version(s)

Web Service Report Generation 6.0.0-6.0.11

Web Service Report Generation 6.2.0-6.2.5

Zabbix agent 2 (MSI packages) 6.0.12rc1

References

https://support.zabbix.com/browse/ZBX-22087

EPSS Score

8% chance of being exploited in the next 30 days.

CVSS V3.1

Score:

5.9

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 15, 2022
Vulnerability Reserved
Dec 7, 2022

Credit

Trend Micro ZDI