Lucene search

[email protected]CVE-2017-2824

HistoryMay 24, 2017 - 2:29 p.m.

CVE-2017-2824

2017-05-2414:29:00

CWE-78

[email protected]

web.nvd.nist.gov

cve-2017-2824

zabbix server

code execution

remote code execution

command injection

security vulnerability

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.716 High

EPSS

Percentile

98.1%

JSON

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.

Affected configurations

Vulners

NVD

Node

zabbixzabbix_serverRange≤2.4.8.r1

VendorProductVersionCPE
zabbixzabbix_server*cpe:2.3:a:zabbix:zabbix_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zabbix	zabbix_server	*	cpe:2.3:a:zabbix:zabbix_server::::::::

CNA Affected

[
  {
    "product": "Zabbix Server",
    "vendor": "Zabbix",
    "versions": [
      {
        "status": "affected",
        "version": "2.4.8.r1"
      }
    ]
  }
]