SQL Injection Affecting zabbix/zabbix package, versions [,1.6.8)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.14% (51st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about SQL Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-UNMANAGED-ZABBIXZABBIX-2364961
  • published26 Jan 2022
  • disclosed31 Dec 2009
  • creditUnknown

Introduced: 31 Dec 2009

CVE-2009-4499  (opens in a new tab)
CWE-89  (opens in a new tab)

How to fix?

Upgrade zabbix/zabbix to version 1.6.8 or higher.

Overview

Affected versions of this package are vulnerable to SQL Injection. SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the send_history_last_id function in zabbix_server/trapper/nodehistory.c.

References

CVSS Scores

version 3.1