CVE-2022-46768

medium · 5.9

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.

5.9

CVSS

47.8%

EPSS (exploit prob.)

99th

EPSS percentile

2022-12-15

Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
zabbix	web_service_report_generation	>= 6.0.0, <= 6.0.11
zabbix	web_service_report_generation	>= 6.2.0, <= 6.2.5
zabbix	zabbix-agent2	< 6.0.12
zabbix	zabbix-agent2	>= 6.2.0, < 6.2.6

Check a specific version with /api/v1/cve/match.

References

https://support.zabbix.com/browse/ZBX-22087
https://support.zabbix.com/browse/ZBX-22087

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-46768