CVE-2016-10742 — Open Redirect in Zabbix

CWE-601 — Open Redirect7 documents6 sources
Severity
6.1MEDIUMNVD
OSV9.8
EPSS
0.4%
top 39.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
ZabbixDebian ZabbixDebian Linux
Timeline
PublishedFeb 17
Latest updateJun 15

Description

Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶debiandebian/zabbix< zabbix 1:3.0.17+dfsg-1 (bookworm)
▶Debianzabbix/zabbix< 1:3.0.17+dfsg-1+3
▶Ubuntuzabbix/zabbix< 1:2.2.2+dfsg-1ubuntu1+esm4+3
▶NVDzabbix/zabbix3.0.0 — 3.0.12+3

Also affects: Debian Linux 8.0

🔴Vulnerability Details

3
OSV
zabbix vulnerabilities↗2022-06-15
▶
GHSA
GHSA-q7cw-45fg-vx6f: Zabbix before 2↗2022-05-13
▶
OSV
CVE-2016-10742: Zabbix before 2↗2019-02-17
▶

📋Vendor Advisories

2
Ubuntu
Zabbix vulnerabilities↗2022-06-15
▶
Debian
CVE-2016-10742: zabbix - Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1,...↗2016
▶

💬Community

1
Bugzilla
CVE-2016-10742 zabbix: open redirection allowed via the request parameter↗2019-02-18
▶