CVE-2022-46768mediumCWE-20

CVE-2022-46768: medium-severity vulnerability in Zabbix Web Service Report Generation

File name information disclosure vulnerability in Zabbix Web Service Report Generation

Published · Updated

Follow this CVE+ Monitor Zabbix agent+ Monitor Web Service Report Generation

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 48%
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Zabbix · Web Service Report GenerationZabbix · Zabbix agent 2 (MSI packages)
Related CVEs — Zabbix Web Service Report Generation

In the same product, most dangerous first.

CVE-2022-43516MEDIUMZabbix Agent installer adds “allow all TCP any any” firewall ruleEPSS 1.0%