CVE-2022-46768 — File name information disclosure vulnerability in Zabbix Web Service Report Generation

CVE-2022-46768

File name information disclosure vulnerability in Zabbix Web Service Report Generation PUBLISHED

Description (CNA)

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.

Affected (CNA)

Vendor / product	Versions
Zabbix / Web Service Report Generation	affected 6.0.0-6.0.11; affected 6.2.0-6.2.5
Zabbix / Zabbix agent 2 (MSI packages)	unaffected 6.0.12rc1 before unspecified; unaffected 6.2.6rc1 before unspecified

CWE

CWE-20

References

https://support.zabbix.com/browse/ZBX-22087

ADP enrichment

CVE

No English description supplied.

https://support.zabbix.com/browse/ZBX-22087

CISA-ADP

No English description supplied.

No references supplied.