Medium severity · published Dec 15, 2022
CVE-2022-46768
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053
5.9
CVSS
47.8%
EPSS
No
On KEV
Description
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)47.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Web Service Report Generation · Zabbix
6.0.0 through 6.0.11; 6.2.0 through 6.2.5 · source: NVD
ZA
Zabbix-agent2 · Zabbix
before 6.0.12; 6.2.0 before 6.2.6 · source: NVD