Detections
Analytics
Zabbix < 1.6.8 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 5270
Synopsis
The remote host is vulnerable to multiple attack vectors.Description
The remote host is running Zabbix, an IT monitoring service. The installed version of Zabbix is earlier than 1.6.8. Such versions are potentially affected by multiple vulnerabilities :- A denial-of-service vulnerability in the 'zbx_get_next_field()' function. (ZBX-1355)
- A SQL-injection vulnerability in the 'send_history_last_id()' function of the 'zabbix_server/trapper/nodehistory.c' source file. (ZBX-1031)
- It is possible for remote unauthenticated users to execute OS commands. (ZBX-1030)
Solution
Upgrade to Zabbix 1.6.8 or later.See Also
https://support.zabbix.com/browse/ZBX-1031
https://support.zabbix.com/browse/ZBX-1355
https://support.zabbix.com/browse/ZBX-1030
Plugin Details
Severity: High
ID: 5270
Family: Generic
Published: 12/17/2009
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:zabbix:zabbix
Patch Publication Date: 11/12/2009
Vulnerability Publication Date: 12/13/2009
Reference Information
CVE: CVE-2009-4499