Zabbix up to 4.4 Dashboard Page zabbix.php improper authentication

entryeditHistoryDiffjsonxmlCTI

A vulnerability has been found in Zabbix up to 4.4 (Network Management Software) and classified as critical. This vulnerability affects an unknown code of the file zabbix.php?action=dashboard.view&dashboardid=1 of the component Dashboard Page. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

Field

Commit Conf

Approve Conf

ID	Commited	User	Field	Change	Remarks	Moderated	Reason	C
9450410	09/29/2020	VulD...	cve_nvd_summary	An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.	mitre.org	09/29/2020	accepted	100
9450409	09/29/2020	VulD...	cve_assigned	1570579200	mitre.org	09/29/2020	accepted	100
9450405	09/29/2020	VulD...	cvss3_nvd_a	N	nist.gov	09/29/2020	accepted	100
9450404	09/29/2020	VulD...	cvss3_nvd_i	H	nist.gov	09/29/2020	accepted	100
9450403	09/29/2020	VulD...	cvss3_nvd_c	H	nist.gov	09/29/2020	accepted	100
9450402	09/29/2020	VulD...	cvss3_nvd_s	U	nist.gov	09/29/2020	accepted	100
9450401	09/29/2020	VulD...	cvss3_nvd_ui	N	nist.gov	09/29/2020	accepted	100
9450400	09/29/2020	VulD...	cvss3_nvd_pr	N	nist.gov	09/29/2020	accepted	100
9450399	09/29/2020	VulD...	cvss3_nvd_ac	L	nist.gov	09/29/2020	accepted	100
9450398	09/29/2020	VulD...	cvss3_nvd_av	N	nist.gov	09/29/2020	accepted	100
9450385	09/29/2020	VulD...	cvss2_nvd_ai	N	nist.gov	09/29/2020	accepted	100
9450384	09/29/2020	VulD...	cvss2_nvd_ii	P	nist.gov	09/29/2020	accepted	100
9450383	09/29/2020	VulD...	cvss2_nvd_ci	P	nist.gov	09/29/2020	accepted	100
9450382	09/29/2020	VulD...	cvss2_nvd_au	N	nist.gov	09/29/2020	accepted	100
9450381	09/29/2020	VulD...	cvss2_nvd_ac	L	nist.gov	09/29/2020	accepted	100
9450380	09/29/2020	VulD...	cvss2_nvd_av	N	nist.gov	09/29/2020	accepted	100
9450370	09/29/2020	VulD...	cwe	287 (weak authentication)		09/29/2020	accepted	100
9450365	09/29/2020	VulD...	type	Network Management Software		09/29/2020	accepted	100
9450417	10/10/2019	VulD...	cvss3_nvd_basescore	9.1	nist.gov	10/10/2019	accepted	90
9450416	10/10/2019	VulD...	cvss3_vuldb_rc	X		10/10/2019	accepted	90