CVE-2017-2826

Severity: low (CVSS 3.7 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-04-09 · updated 2026-06-17
Weakness: CWE-200

Description

An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker can make requests from an active Zabbix proxy to trigger this vulnerability.

Affected products

Debian Linux: 8.0
Zabbix: 2.4.0, 2.4.0-rc1, 2.4.0-rc2, 2.4.0-rc3, 2.4.1, 2.4.1-rc1 (+17)

References

https://lists.debian.org/debian-lts-announce/2019/03/msg00010.html
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0327
https://lists.debian.org/debian-lts-announce/2019/03/msg00010.html
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0327

Get alerted when CVE-2017-2826 or the next vulnerability affects your stack