CVE-2022-46768CWE-20

File name information disclosure vulnerability in Zabbix Web Service Report Generation

Medium · published December 19, 2022

CVSS v3.1

5.9

EPSS

48%

Percentile

98.9

In the wild

Unconfirmed

What it is

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.

The record

Technical detail

CVSS v3.1: 5.9 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.47772 · 98.9th percentile
Weakness: CWE-20 · Improper Input Validation
Published: 2022-12-19T10:00Z

EPSS history

Timeline

19 DEC 10:00Z
File name information disclosure vulnerability in Zabbix Web Service Report Generation
cvelistv5