vulnwire
3.7low

CVE-2017-2826

An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
3.7
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.3%
percentile 88%
Public exploits
0
none known

An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker can make requests from an active Zabbix proxy to trigger this vulnerability.

Exploit prediction (EPSS)

3.27% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.03.7CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • Talos Zabbix

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • talosintelligence.com /vulnerability_reports/TALOS-2017-0327 · x_refsource_MISC, x_transferred
  • lists.debian.org /debian-lts-announce/2019/03/msg00010.html · mailing-list, x_refsource_MLIST, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.