What is CVE-2022-46768?

CVE-2022-46768 is a medium-severity vulnerability in Zabbix Web Service Report Generation, classified under Improper Input Validation. CVSS score: 5.9/10. Published 2022-12-15.

How severe is CVE-2022-46768?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Improper input validation in Zabbix Web Service Report Generation

CVE-2022-46768

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.478 (98.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Zabbix Web Service Report Generation — versions 6.0.0-6.0.11, 6.2.0-6.2.5
Zabbix Web_service_report_generation
Zabbix Zabbix-agent2
Zabbix Agent 2 (Msi Packages) — versions 6.0.12rc1, 6.2.6rc1

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

security@zabbix.com (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2022-46768?: CVE-2022-46768 is a medium-severity vulnerability in Zabbix Web Service Report Generation, classified under Improper Input Validation. CVSS score: 5.9/10. Published 2022-12-15.
How severe is CVE-2022-46768?: Medium severity. CVSS v3 base score is 5.9 out of 10.