-
Notifications
You must be signed in to change notification settings - Fork 206
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- 1 new CVEs: CVE-2024-36466 - 1 updated CVEs: CVE-2024-0854
- Loading branch information
cvelistV5 Github Action
committed
Nov 28, 2024
1 parent
16a3ba2
commit 1349e44
Showing
4 changed files
with
202 additions
and
17 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,158 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2024-36466", | ||
| "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "Zabbix", | ||
| "dateReserved": "2024-05-28T11:21:24.947Z", | ||
| "datePublished": "2024-11-28T07:19:48.806Z", | ||
| "dateUpdated": "2024-11-28T07:19:48.806Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "affected": [ | ||
| { | ||
| "defaultStatus": "unaffected", | ||
| "modules": [ | ||
| "Frontend" | ||
| ], | ||
| "product": "Zabbix", | ||
| "repo": "https://git.zabbix.com/", | ||
| "vendor": "Zabbix", | ||
| "versions": [ | ||
| { | ||
| "changes": [ | ||
| { | ||
| "at": "6.0.32rc1", | ||
| "status": "unaffected" | ||
| } | ||
| ], | ||
| "lessThanOrEqual": "6.0.31", | ||
| "status": "affected", | ||
| "version": "6.0.0", | ||
| "versionType": "git" | ||
| }, | ||
| { | ||
| "changes": [ | ||
| { | ||
| "at": "6.4.17rc1", | ||
| "status": "unaffected" | ||
| } | ||
| ], | ||
| "lessThanOrEqual": "6.4.16", | ||
| "status": "affected", | ||
| "version": "6.4.0", | ||
| "versionType": "git" | ||
| }, | ||
| { | ||
| "status": "affected", | ||
| "version": "7.0.0", | ||
| "versionType": "git" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "credits": [ | ||
| { | ||
| "lang": "en", | ||
| "type": "finder", | ||
| "value": "Zabbix wants to thank Márk Rákóczi (reeeeeeeeeeee) for submitting this report on the HackerOne bug bounty platform." | ||
| } | ||
| ], | ||
| "datePublic": "2024-07-02T13:25:00.000Z", | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "supportingMedia": [ | ||
| { | ||
| "base64": false, | ||
| "type": "text/html", | ||
| "value": "A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions.<br>" | ||
| } | ||
| ], | ||
| "value": "A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions." | ||
| } | ||
| ], | ||
| "impacts": [ | ||
| { | ||
| "capecId": "CAPEC-196", | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "CAPEC-196 Session Credential Falsification through Forging" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "metrics": [ | ||
| { | ||
| "cvssV3_1": { | ||
| "attackComplexity": "LOW", | ||
| "attackVector": "NETWORK", | ||
| "availabilityImpact": "HIGH", | ||
| "baseScore": 8.8, | ||
| "baseSeverity": "HIGH", | ||
| "confidentialityImpact": "HIGH", | ||
| "integrityImpact": "HIGH", | ||
| "privilegesRequired": "LOW", | ||
| "scope": "UNCHANGED", | ||
| "userInteraction": "NONE", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", | ||
| "version": "3.1" | ||
| }, | ||
| "format": "CVSS", | ||
| "scenarios": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "GENERAL" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-290", | ||
| "description": "CWE-290 Authentication Bypass by Spoofing", | ||
| "lang": "en", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", | ||
| "shortName": "Zabbix", | ||
| "dateUpdated": "2024-11-28T07:19:48.806Z" | ||
| }, | ||
| "references": [ | ||
| { | ||
| "url": "https://support.zabbix.com/browse/ZBX-25635" | ||
| } | ||
| ], | ||
| "source": { | ||
| "discovery": "EXTERNAL" | ||
| }, | ||
| "title": "Unauthenticated Zabbix frontend takeover when SSO is being used", | ||
| "workarounds": [ | ||
| { | ||
| "lang": "en", | ||
| "supportingMedia": [ | ||
| { | ||
| "base64": false, | ||
| "type": "text/html", | ||
| "value": "Disabling SSO authentication method" | ||
| } | ||
| ], | ||
| "value": "Disabling SSO authentication method" | ||
| } | ||
| ], | ||
| "x_generator": { | ||
| "engine": "Vulnogram 0.2.0" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters