Skip to content
OpenAdvisories
High WID-SEC-2023-3167 4 CVEs

Zabbix: Mehrere Schwachstellen

Published Dec 17, 2023 · Updated Oct 3, 2024 · Revision 5 · de-DE

Vendor: Debian Vendor: Fedora Vendor: Zabbix Product: Linux Product: Linux Product: Zabbix Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Zabbix ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Code auszuführen.

Product

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Vulnerabilities 4

  • Critical 9.6
    CVE-2023-32725

    Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.

    The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.

    Zabbix Zabbix zabbix Debian
  • Medium 6.8
    CVE-2023-32727

    Code execution vulnerability in icmpping

    An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 4.6
    CVE-2023-32728

    Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin

    The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Low 3.9
    CVE-2023-32726

    Possible buffer overread from reading DNS responses

    The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu

Revision history

  1. #5

    Neue Updates von Debian aufgenommen

  2. #4

    Neue Updates von Debian aufgenommen

  3. #3

    Advisory-interne Referenzierungen korrigiert

  4. #2

    Neue Updates von Fedora aufgenommen

  5. #1

    Initiale Fassung

References