title: Unauthorized limited filesystem access from preprocessing
description: JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
modules: [Server, Proxy]
product: Zabbix
repo: https://git.zabbix.com/
vendor: Zabbix
versions:
changes: [at: 5.0.32rc1, status: unaffected], lessThanOrEqual: 5.0.31, status: affected, version: 5.0, versionType: git
changes: [at: 6.0.14rc1 (6.0.16 is recommended), status: unaffected], lessThanOrEqual: 6.0.13, status: affected, version: 6.0, versionType: git
changes: [at: 6.2.8rc1, status: unaffected], lessThanOrEqual: 6.2.7, status: affected, version: 6.2, versionType: git
changes: [at: 6.4.0rc2, status: unaffected], lessThanOrEqual: 6.4.0rc1, status: affected, version: 6.4, versionType: git
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL