[ZBX-16765] Bypass Auth When using application/x-www-form-urlencoded Created: 2019 Oct 14 Updated: 2020 Jul 16 Resolved: 2019 Oct 15 |
|
| Status: | Closed |
| Project: | ZABBIX BUGS AND ISSUES |
| Component/s: | Frontend (F) |
| Affects Version/s: | 4.4.0 |
| Fix Version/s: | None |
| Type: | Defect (Security) | Priority: | Critical |
| Reporter: | Mickael Martin | Assignee: | Unassigned |
| Resolution: | Won't fix | Votes: | 0 |
| Labels: | frontend, security | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||||||||||
| Description |
| Comments |
| Comment by Valdis Murzins [ 2019 Oct 14 ] |
|
Hello mma, From what I see, these pages are accessible, because system has guest account enabled. With enabled guest account, any unauthenticated request is performed by this guest user. |
| Comment by Mickael Martin [ 2019 Oct 15 ] |
|
Yes, exactly. Disable guest user remove access. You can close, sorry. |
| Comment by Mickael Martin [ 2019 Oct 15 ] |
|
Disable guest user remove public access (normal !).
|
| Comment by Mickael Martin [ 2019 Oct 15 ] |
|
But maybe you can hide the 'system information' block : the guest can see important informations and know if it's a small/demo server or an important server. Stats and status seams sensitives informations. |
| Comment by Valdis Murzins [ 2019 Nov 01 ] |
|
In |