.. / CVE-2019-17382

• Auth Bypass
• Nuclei
• Web

Exploit for Zabbix <=4.4 - Authentication Bypass (CVE-2019-17382)

Description:

Zabbix through 4.4 is susceptible to an authentication bypass vulnerability via zabbix.php?action=dashboard.view&dashboardid=1. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.

Nuclei Template

View the template here CVE-2019-17382.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-17382.yaml

References: