Vulnerability Name:
CVE-2013-1364 (CCN-81423)
Assigned:
2013-01-20
Published:
2013-01-20
Updated:
2013-12-16
Summary:
The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.
CVSS v3 Severity:
5.3 Medium
(CCN CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
)
Exploitability Metrics:
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope:
Scope (S):
Unchanged
Impact Metrics:
Confidentiality (C):
None
Integrity (I):
Low
Availibility (A):
None
CVSS v2 Severity:
5.0 Medium
(CVSS v2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
)
3.7 Low
(Temporal CVSS v2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C
)
Exploitability Metrics:
Access Vector (AV):
Network
Access Complexity (AC):
Low
Authentication (Au):
None
Impact Metrics:
Confidentiality (C):
None
Integrity (I):
Partial
Availibility (A):
None
5.0 Medium
(CCN CVSS v2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
)
3.7 Low
(CCN Temporal CVSS v2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C
)
Exploitability Metrics:
Access Vector (AV):
Network
Access Complexity (AC):
Low
Athentication (Au):
None
Impact Metrics:
Confidentiality (C):
None
Integrity (I):
Partial
Availibility (A):
None
Vulnerability Type:
CWE-287
Vulnerability Consequences:
Bypass Security
References:
Source: MITRE
Type: CNA
CVE-2013-1364
Source: CCN
Type: SA51909
Zabbix "cnf" LDAP Authentication Security Bypass Vulnerability
Source: CCN
Type: SA51910
Zabbix "cnf" LDAP Authentication Security Bypass Vulnerability
Source: SECUNIA
Type: Vendor Advisory
55824
Source: GENTOO
Type: UNKNOWN
GLSA-201311-15
Source: BID
Type: UNKNOWN
57471
Source: CCN
Type: BID-57471
Zabbix 'cnf' Parameter Authentication Bypass Vulnerability
Source: CCN
Type: Zabbix Web Site
Homepage of Zabbix :: An Enterprise-Class Open Source Distributed Monitoring Solution
Source: CONFIRM
Type: Vendor Advisory
http://www.zabbix.com/rn1.8.16.php
Source: CONFIRM
Type: Vendor Advisory
http://www.zabbix.com/rn2.0.5rc1.php
Source: CCN
Type: Red Hat Bugzilla Bug 901876
CVE-2013-1364 zabbix: possible to override LDAP configuration parameters via the API [epel-6]
Source: XF
Type: UNKNOWN
zabbix-userlogin-sec-bypass(81423)
Source: CONFIRM
Type: UNKNOWN
https://support.zabbix.com/browse/ZBX-6097
Vulnerable Configuration:
Configuration 1
:
cpe:/a:zabbix:zabbix:*:*:*:*:*:*:*:*
(Version <= 1.8.15)
OR
cpe:/a:zabbix:zabbix:2.0.0:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:2.0.1:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:2.0.2:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:2.0.3:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:2.0.4:*:*:*:*:*:*:*
Configuration CCN 1
:
cpe:/a:zabbix:zabbix:1.8:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.2:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.1:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.3:rc1:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.3:rc2:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.3:rc3:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.5:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.3:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.4:rc1:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.4:rc2:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.4:rc3:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.4:rc4:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.5:rc1:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.4:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.6:rc1:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.6:rc2:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.6:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.10:rc2:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.10:rc1:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.9:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.9:rc2:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.9:rc1:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.8:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.8:rc3:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.8:rc2:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.8:rc1:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.7:*:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.7:rc1:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:1.8.3:rc4:*:*:*:*:*:*
OR
cpe:/a:zabbix:zabbix:2.0.4:*:*:*:*:*:*:*
Denotes that component is vulnerable
Oval Definitions
Definition ID
Class
Title
Last Modified
oval:com.ubuntu.precise:def:20131364000
V
CVE-2013-1364 on Ubuntu 12.04 LTS (precise) - high.
2013-12-14
oval:com.ubuntu.trusty:def:20131364000
V
CVE-2013-1364 on Ubuntu 14.04 LTS (trusty) - high.
2013-12-14
oval:com.ubuntu.xenial:def:20131364000
V
CVE-2013-1364 on Ubuntu 16.04 LTS (xenial) - high.
2013-12-14
oval:com.ubuntu.xenial:def:201313640000000
V
CVE-2013-1364 on Ubuntu 16.04 LTS (xenial) - high.
2013-12-14
BACK
zabbix
zabbix *
zabbix
zabbix 2.0.0
zabbix
zabbix 2.0.1
zabbix
zabbix 2.0.2
zabbix
zabbix 2.0.3
zabbix
zabbix 2.0.4
zabbix
zabbix 1.8
zabbix
zabbix 1.8.2
zabbix
zabbix 1.8.1
zabbix
zabbix 1.8.3 rc1
zabbix
zabbix 1.8.3 rc2
zabbix
zabbix 1.8.3 rc3
zabbix
zabbix 1.8.5
zabbix
zabbix 1.8.3
zabbix
zabbix 1.8.4 rc1
zabbix
zabbix 1.8.4 rc2
zabbix
zabbix 1.8.4 rc3
zabbix
zabbix 1.8.4 rc4
zabbix
zabbix 1.8.5 rc1
zabbix
zabbix 1.8.4
zabbix
zabbix 1.8.6 rc1
zabbix
zabbix 1.8.6 rc2
zabbix
zabbix 1.8.6
zabbix
zabbix 1.8.10 rc2
zabbix
zabbix 1.8.10 rc1
zabbix
zabbix 1.8.9
zabbix
zabbix 1.8.9 rc2
zabbix
zabbix 1.8.9 rc1
zabbix
zabbix 1.8.8
zabbix
zabbix 1.8.8 rc3
zabbix
zabbix 1.8.8 rc2
zabbix
zabbix 1.8.8 rc1
zabbix
zabbix 1.8.7
zabbix
zabbix 1.8.7 rc1
zabbix
zabbix 1.8.3 rc4
zabbix
zabbix 2.0.4