CVE-2011-3265

Zabbix < 1.8.7 - Unauthenticated Exposure of Sensitive Information via popup.php srctbl Parameter

Title source: llm
STIX 2.1

Description

popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter.

References (6)

Core 6
Core References
Various Sources x_refsource_confirm
https://support.zabbix.com/browse/ZBX-3840
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066092.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/49277
Various Sources x_refsource_confirm
https://support.zabbix.com/browse/ZBX-3955
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/69376
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066110.html

Scores

EPSS 0.0146
EPSS Percentile 70.6%

Details

CWE
CWE-200
Status published
Products (39)
zabbix/zabbix 1.1 (12 CPE variants)
zabbix/zabbix 1.1.1
zabbix/zabbix 1.1.2
zabbix/zabbix 1.1.3
zabbix/zabbix 1.1.4
zabbix/zabbix 1.1.5
zabbix/zabbix 1.1.6
zabbix/zabbix 1.1.7
zabbix/zabbix 1.3 beta
zabbix/zabbix 1.3.1 beta
... and 29 more
Published Aug 19, 2011
Tracked Since Feb 18, 2026