CVE-2017-2826
Summary
| CVE | CVE-2017-2826 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-04-09 20:29:00 UTC |
| Updated | 2019-03-13 17:50:00 UTC |
| Description | An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker can make requests from an active Zabbix proxy to trigger this vulnerability. |
Risk And Classification
Problem Types: CWE-200
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.0 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.0 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.0 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.4.0 | rc3 | All | All |
| Application | Zabbix | Zabbix | 2.4.1 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.1 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.1 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.4.2 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.2 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.3 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.3 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.4 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.4 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.5 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.5 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.6 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.6 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.7 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.7 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.8 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.8 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.9 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.9 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.0 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.0 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.0 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.4.0 | rc3 | All | All |
| Application | Zabbix | Zabbix | 2.4.1 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.1 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.1 | rc2 | All | All |
| Application | Zabbix | Zabbix | 2.4.2 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.2 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.3 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.3 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.4 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.4 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.5 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.5 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.6 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.6 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.7 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.7 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.8 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.8 | rc1 | All | All |
| Application | Zabbix | Zabbix | 2.4.9 | All | All | All |
| Application | Zabbix | Zabbix | 2.4.9 | rc1 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] [DLA 1708-1] zabbix security update | MLIST | lists.debian.org | Mailing List, Third Party Advisory |
| TALOS-2017-0327 || Cisco Talos Intelligence Group - Comprehensive Threat Intelligence | MISC | talosintelligence.com | Exploit, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.