Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4767-1 advisory.

    Fu Chuang discovered that Zabbix did not properly parse IPs. A remote attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu     18.04 ESM. (CVE-2020-11800)

    It was discovered that Zabbix incorrectly handled certain requests. A remote attacker could possibly use     this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
    (CVE-2017-2824, CVE-2017-2825)

    It was discovered that Zabbix incorrectly handled certain XML files. A remote attacker could possibly use     this issue to read arbitrary files or potentially execute arbitrary code. This issue only affected Ubuntu     14.04 ESM. (CVE-2014-3005)

    It was discovered that Zabbix incorrectly handled certain inputs. A remote attacker could possibly use     this issue to execute arbitrary SQL commands. This issue only affected Ubuntu 14.04 ESM. (CVE-2016-10134,     CVE-2016-4338)

    It was discovered that Zabbix incorrectly handled the request parameter. A remote attacker could possibly     use this issue to redirect requests to external links. This issue only affected Ubuntu 14.04 ESM and     Ubuntu 18.04 ESM. (CVE-2016-10742)

    It was discovered that Zabbix incorrectly handled failed login attempts. A remote attacker could possibly     use this issue to enumerate users. (CVE-2019-15132)

    It was discovered that Zabbix did not properly validate input. A remote attacker could exploit this to     conduct cross-site scripting (XSS) attacks. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM     and Ubuntu 20.04 ESM. (CVE-2020-15803)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3390 advisory.

  - Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate     application usernames based on the variability of server responses (e.g., the Login name or password is     incorrect and No permissions for system access messages, or just blocking for a number of seconds).
    This affects both api_jsonrpc.php and index.php. (CVE-2019-15132)

  - Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before     5.0.2rc1 allows stored XSS in the URL Widget. (CVE-2020-15803)

  - In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and     5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection     mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker     doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact     information of an existing user with sufficient privileges. (CVE-2021-27927)

  - An authenticated user can create a link with reflected XSS payload for actions' pages, and send it to     other users. Malicious code has access to all the same objects as the rest of the web page and can make     arbitrary modifications to the contents of the page being displayed to a victim. This attack can be     implemented with the help of social engineering and expiration of a number of factors - an attacker should     have authorized access to the Zabbix Frontend and allowed network connection between a malicious server     and victim's computer, understand attacked infrastructure, be recognized by the victim as a trustee and     use trusted communication channel. (CVE-2022-24349)

  - An authenticated user can create a link with reflected Javascript code inside it for services' page and     send it to other users. The payload can be executed only with a known CSRF token value of the victim,     which is changed periodically and is difficult to predict. Malicious code has access to all the same     objects as the rest of the web page and can make arbitrary modifications to the contents of the page being     displayed to a victim during social engineering attacks. (CVE-2022-24917)

  - An authenticated user can create a link with reflected Javascript code inside it for graphs' page and send     it to other users. The payload can be executed only with a known CSRF token value of the victim, which is     changed periodically and is difficult to predict. Malicious code has access to all the same objects as the     rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a     victim during social engineering attacks. (CVE-2022-24919)

  - An authenticated user can create a link with reflected Javascript code inside it for the graphs page and     send it to other users. The payload can be executed only with a known CSRF token value of the victim,     which is changed periodically and is difficult to predict. (CVE-2022-35230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in Zabbix, a network monitoring solution. An attacker may enumerate valid users and redirect to external links through the zabbix web frontend.

CVE-2019-15132

Zabbix allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the 'Login name or password is incorrect' and 'No permissions for system access' messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.

CVE-2020-15803

Zabbix allows stored XSS in the URL Widget. This fix was mistakenly dropped in previous upload 1:3.0.31+dfsg-0+deb9u1.

This update also includes several other bug fixes and improvements.
For more information please refer to the upstream changelog file.

For Debian 9 stretch, these problems have been fixed in version 1:3.0.32+dfsg-0+deb9u1.

We recommend that you upgrade your zabbix packages.

For the detailed security status of zabbix please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/zabbix

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183641	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Zabbix vulnerabilities (USN-4767-1)	Nessus	Ubuntu Local Security Checks	critical
174179	Debian DLA-3390-1 : zabbix - LTS security update	Nessus	Debian Local Security Checks	high
148926	Debian DLA-2631-1 : zabbix security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-15132

medium

Tenable Plugins

critical

high

medium