CVE-2013-5572

Description

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

How to fix CVE-2013-5572

To remediate CVE-2013-5572, upgrade the affected package to a fixed version below.

• Debian/zabbix—upgrade to 1:2.2.2+dfsg-1 or later

Is CVE-2013-5572 being exploited?

Low — EPSS is 4.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1:2.2.2+dfsg-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2013-5572