PatchFirst · Vulnerabilidades recientes
Vulnerabilidades conocidas que afectan a zabbix 7.4.3: 23. Compara las versiones corregidas de abajo con la que tienes instalada.
Vulnerabilidades: 23
An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.