Files or Directories Accessible to External Parties in Zabbix - CVE-2023-29450

Vulnerability identifier: #VU78841

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-29450

CWE-ID: CWE-552

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper access restrictions when processing JavaScript. A remote attacker can view contents of arbitrary files on the system.

Zabbix
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
zabbix-debugsource
zabbix-agent-debuginfo
zabbix-agent

Install updates from vendor's website.

Zabbix - addressed in versions 5.0.34 rc1, 6.0.16 rc1, 6.2.9 rc2, 6.4.2 rc1
zabbix-debugsource - update to 4.0.12-4.24.1
zabbix-agent-debuginfo - update to 4.0.12-4.24.1
zabbix-agent - update to 4.0.12-4.24.1

• https://support.zabbix.com/browse/ZBX-22588

• Information disclosure in Zabbix
• SUSE update for zabbix