Security flaw with API access when using HTTP authentication

XMLWordPrintable

      When Zabbix is configured with HTTP authentication, the API uses permissions of the user passed to the user.login call. Therefore, as long as you can authenticate to the Zabbix server, you could impersonate any user via the API by passing another username to the user.login request.

      CVE-2014-1682

        1. ZBX-7703-1.8.2.patch
          0.9 kB
        2. ZBX-7703-2.2.1.patch
          1 kB

            Assignee:
            Unassigned
            Reporter:
            Vitaly Shupak
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: