CVE-2019-17382

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.

Se detectó un problema en zabbix.php?action=dashboard.view&dashboardid=1 en Zabbix versiones hasta 4.4. Un atacante puede omitir la página login y acceder a la página dashboard, y luego crear un Dashboard, Report, Screen, o Map sin ningún Nombre de Usuario/Contraseña (es decir, de forma anónima). Todos los elementos creados (Dashboard/Report/Screen/Map) son accesibles por otros usuarios y por un administrador.