#VU33853 Input validation error - CVE-2014-1685

Vulnerability identifier: #VU33853

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-1685

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Description

The vulnerability allows a remote #AU# to manipulate or delete data.

The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors.

Mitigation
Install update from vendor's website.

External links
https://lists.fedoraproject.org/pipermail/package-announce/2014-May/132376.html
https://lists.fedoraproject.org/pipermail/package-announce/2014-May/132377.html
https://support.zabbix.com/browse/ZBX-7693

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.