CriticalFix available
zabbix — security advisory
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
- Products
- zabbix
- Affected versions
- Not specified
- Fixed versions
- 1:2.2.5+dfsg-1
- CVEs
- CVE-2014-3005
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 21:51 UTC · Revision 1
Source evidence
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
osv:DEBIAN-CVE-2014-3005
zabbix
Fixed versions: 1:2.2.5+dfsg-1
zabbix
Fixed versions: 1:2.2.5+dfsg-1
zabbix
Fixed versions: 1:2.2.5+dfsg-1
Complete source record
{
"id": "fe096e745b0982252d14749e253c3d3fb64d45f41f2e5e1f8cac79adbf4bee23",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2014-3005",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2014-3005",
"summary": "XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.",
"evidence": "osv:DEBIAN-CVE-2014-3005",
"products": [
{
"name": {
"value": "zabbix",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:2.2.5+dfsg-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "zabbix",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:2.2.5+dfsg-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "zabbix",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:2.2.5+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2014-3005",
"aliases": [
"DEBIAN-CVE-2014-3005"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:2.2.5+dfsg-1"
}
]
}
],
"package": {
"name": "zabbix",
"purl": "pkg:deb/debian/zabbix?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-3005.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:2.2.5+dfsg-1"
}
]
}
],
"package": {
"name": "zabbix",
"purl": "pkg:deb/debian/zabbix?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-3005.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:2.2.5+dfsg-1"
}
]
}
],
"package": {
"name": "zabbix",
"purl": "pkg:deb/debian/zabbix?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-3005.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T16:00:43.066124409Z",
"provider": "osv",
"upstream": [
"CVE-2014-3005"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2014-3005"
]
},
"related_cves": [
{
"value": "CVE-2014-3005",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 414687,
"published_at": "2018-02-01T17:29:00.463+00:00"
}