CVE-2014-3005
Published: 1 February 2018
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
From the Ubuntu Security Team
It was discovered that Zabbix incorrectly handled certain XML files. A remote attacker could possibly use this issue to read arbitrary files or potentially execute arbitrary code.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
zabbix Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
| bionic |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| cosmic |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| disco |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| eoan |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| focal |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| groovy |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| hirsute |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| impish |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| jammy |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| lucid |
Ignored
(end of life)
|
|
| precise |
Ignored
(end of life)
|
|
| saucy |
Ignored
(end of life)
|
|
| trusty |
Released
(1:2.2.2+dfsg-1ubuntu1+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Released
(1:2.2.5+dfsg-1)
|
|
| utopic |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| vivid |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| wily |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| xenial |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| yakkety |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
| zesty |
Not vulnerable
(1:2.2.5+dfsg-1ubuntu1)
|
|
|
Patches: upstream: https://support.zabbix.com/secure/attachment/28912/ZBX_8151_2_2_2.patch |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |