CVE-2022-46768

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Zabbix	Web Service Report Generation	6.0.0-6.0.11; 6.2.0-6.2.5
Zabbix	Zabbix agent 2 (MSI packages)	—

References

https://support.zabbix.com/browse/ZBX-22087Patch, Vendor Advisory
https://support.zabbix.com/browse/ZBX-22087Patch, Vendor Advisory

Timeline

Published: Dec 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-467695.4An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.CVE-2022-46775.4The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users CVE-2022-467707.5qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumpt CVE-2022-467714.6IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.18, 7.0.5.0 through 7.0.5.13, 7.1.0.0 through 7.1.2.9, 7.2.0.0 through 7.2.3.2 and 7.3.0.0 CVE-2022-467736.5IBM Robotic Process Automation 21.0.0 - 21.0.7 and 23.0.0 is vulnerable to client-side validation bypass for credential pools. Invalid crede CVE-2022-467746.5IBM Manage Application 8.8.0 and 8.9.0 in the IBM Maximo Application Suite is vulnerable to incorrect default permissions which could give a CVE-2022-46785.4The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them CVE-2022-467813.3An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU memory processing operations to acces CVE-2022-467827.8An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the Ope CVE-2022-467835.3An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access th CVE-2022-467846.1SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was originally found in 5.5.1 GA.)CVE-2022-467856.1SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 1 of 2).