CVE-2014-9450
Summary
| CVE | CVE-2014-9450 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-01-02 20:59:09 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Zabbix | Zabbix | 2.0.1 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.1 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.1 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.0.10 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.10 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.11 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.11 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.11 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.0.12 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.12 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.12 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.0.12 | rc3 | All | All |
| Application | Zabbix | Zabbix | 2.0.13 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.13 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.2 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.2 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.2 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.0.3 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.3 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.3 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.0.4 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.4 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.5 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.5 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.6 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.6 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.7 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.8 | All | All | All |
| Application | Zabbix | Zabbix | 2.0.8 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.8 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.0.9 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.0.9 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.2.0 | All | All | All |
| Application | Zabbix | Zabbix | 2.2.0 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.2.0 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.2.1 | All | All | All |
| Application | Zabbix | Zabbix | 2.2.1 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.2.2 | All | All | All |
| Application | Zabbix | Zabbix | 2.2.2 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.2.2 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.2.2 | rc3 | All | All |
| Application | Zabbix | Zabbix | 2.2.3 | All | All | All |
| Application | Zabbix | Zabbix | 2.2.3 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.2.3 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.2.4 | All | All | All |
| Application | Zabbix | Zabbix | 2.2.4 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.2.4 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.2.4 | rc3 | All | All |
| Application | Zabbix | Zabbix | 2.2.4 | rc4 | All | All |
| Application | Zabbix | Zabbix | 2.2.5 | All | All | All |
| Application | Zabbix | Zabbix | 2.2.5 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.2.6 | All | All | All |
| Application | Zabbix | Zabbix | 2.2.6 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.2.7 | All | All | All |
| Application | Zabbix | Zabbix | 2.2.7 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.2.7 | rc2 | All | All |
| Application | Zabbix | Zabbix | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Homepage of Zabbix :: An Enterprise-Class Open Source Distributed Monitoring Solution | af854a3a-2127-422b-91ae-364da2661108 | www.zabbix.com | Vendor Advisory |
| Homepage of Zabbix :: An Enterprise-Class Open Source Distributed Monitoring Solution | af854a3a-2127-422b-91ae-364da2661108 | www.zabbix.com | Vendor Advisory |
| Homepage of Zabbix :: An Enterprise-Class Open Source Distributed Monitoring Solution | af854a3a-2127-422b-91ae-364da2661108 | www.zabbix.com | Vendor Advisory |
| [ZBX-8582] SQL inject in zabbix frontend. - ZABBIX SUPPORT | af854a3a-2127-422b-91ae-364da2661108 | support.zabbix.com | Vendor Advisory |
| Security Advisory SA61554 - Zabbix Two SQL Injection Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.