Test ID:	1.3.6.1.4.1.25623.1.0.892631
Category:	Debian Local Security Checks
Title:	Debian LTS: Security Advisory for zabbix (DLA-2631-1)
Summary:	The remote host is missing an update for the 'zabbix'; package(s) announced via the DLA-2631-1 advisory.
Description:	Summary: The remote host is missing an update for the 'zabbix' package(s) announced via the DLA-2631-1 advisory. Vulnerability Insight: Multiple vulnerabilities were discovered in Zabbix, a network monitoring solution. An attacker may enumerate valid users and redirect to external links through the zabbix web frontend. CVE-2019-15132 Zabbix allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the 'Login name or password is incorrect' and 'No permissions for system access' messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php. CVE-2020-15803 Zabbix allows stored XSS in the URL Widget. This fix was mistakenly dropped in previous upload 1:3.0.31+dfsg-0+deb9u1. This update also includes several other bug fixes and improvements. For more information please refer to the upstream changelog file. Affected Software/OS: 'zabbix' package(s) on Debian Linux. Solution: For Debian 9 stretch, these problems have been fixed in version 1:3.0.32+dfsg-0+deb9u1. We recommend that you upgrade your zabbix packages. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-15132 Common Vulnerability Exposure (CVE) ID: CVE-2020-15803
Copyright	Copyright (C) 2021 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.