CVE-2019-17382

nvd nist nuclei

Published: Oct 9, 2019Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.

Affected (1)

Products: Zabbix: Zabbix

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zabbix Zabbix	Up to 4.4

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html

Source: cve@mitre.org

https://www.exploit-db.com/exploits/47467

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/47467

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.