CVE-2023-32727

2023-12-1810:15:06

CWE-20

[email protected]

web.nvd.nist.gov

cve

zabbix

security

code execution

nvd

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

JSON

An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.

CPE configuration

NVD

zabbixzabbix_serverRange4.0.0–4.0.49

zabbixzabbix_serverRange5.0.0–5.0.38

zabbixzabbix_serverRange6.0.0–6.0.22

zabbixzabbix_serverRange6.4.0–6.4.7

zabbixzabbix_serverMatch7.0.0alpha1

zabbixzabbix_serverMatch7.0.0alpha2

zabbixzabbix_serverMatch7.0.0alpha3

zabbixzabbix_serverMatch7.0.0alpha6

CPENameOperatorVersion
zabbix:zabbix_serverzabbix zabbix serverle4.0.49
zabbix:zabbix_serverzabbix zabbix serverle5.0.38
zabbix:zabbix_serverzabbix zabbix serverle6.0.22
zabbix:zabbix_serverzabbix zabbix serverle6.4.7
zabbix:zabbix_serverzabbix zabbix servereq7.0.0

CPE	Name	Operator	Version
zabbix:zabbix_server	zabbix zabbix server	le	4.0.49
zabbix:zabbix_server	zabbix zabbix server	le	5.0.38
zabbix:zabbix_server	zabbix zabbix server	le	6.0.22
zabbix:zabbix_server	zabbix zabbix server	le	6.4.7
zabbix:zabbix_server	zabbix zabbix server	eq	7.0.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Server"
    ],
    "product": "Zabbix",
    "repo": "https://git.zabbix.com/",
    "vendor": "Zabbix",
    "versions": [
      {
        "changes": [
          {
            "at": "4.0.50",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "4.0.49",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "5.0.39",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "5.0.38",
        "status": "affected",
        "version": "5.0.0 ",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.0.23rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.0.22",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.4.8rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.4.7",
        "status": "affected",
        "version": "6.4.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "7.0.0alpha7",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "7.0.0alpha6",
        "status": "affected",
        "version": "7.0.0alpha1",
        "versionType": "git"
      }
    ]
  }
]