PatchFirst · Vulnérabilités récentes
Vulnérabilités connues concernant zabbix 7.4.3 : 23. Comparez les versions corrigées ci-dessous avec celle que vous utilisez.
Vulnérabilités : 23
An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.