[ZBX-16789] CVE-2019-17382 An attacker can bypass the login page and access the dashboard page ( CVSS: 9.1 Critical ) Created: 2019 Oct 17 Updated: 2019 Oct 17 Resolved: 2019 Oct 17 |
|
| Status: | Closed |
| Project: | ZABBIX BUGS AND ISSUES |
| Component/s: | Frontend (F) |
| Affects Version/s: | 4.4.0 |
| Fix Version/s: | None |
| Type: | Incident report | Priority: | Minor |
| Reporter: | Kim Jongkwon | Assignee: | Unassigned |
| Resolution: | Duplicate | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||
| Description |
|
CVE-2019-17382 was described and it became public information in October. An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin. Related info: |
| Comments |
| Comment by Valdis Murzins [ 2019 Oct 17 ] |
|
Hello, This is not a security issue, as explained in |