Lucene search

[email protected]CVE-2022-23132

HistoryJan 13, 2022 - 4:15 p.m.

CVE-2022-23132

2022-01-1316:15:08

CWE-284

CWE-732

[email protected]

web.nvd.nist.gov

zabbix

rpm

installation

cve-2022-23132

permissions

selinux

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.4%

JSON

During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level

Affected configurations

NVD

Node

zabbixzabbixRange4.0.0–4.0.36

zabbixzabbixRange5.0.0–5.0.18

zabbixzabbixRange5.4.0–5.4.8

zabbixzabbixMatch6.0.0alpha1

zabbixzabbixMatch6.0.0alpha2

zabbixzabbixMatch6.0.0alpha3

zabbixzabbixMatch6.0.0alpha4

zabbixzabbixMatch6.0.0alpha5

zabbixzabbixMatch6.0.0alpha6

zabbixzabbixMatch6.0.0alpha7

Node

fedoraprojectfedoraMatch34

fedoraprojectfedoraMatch35

CPENameOperatorVersion
zabbix:zabbixzabbixle4.0.36
zabbix:zabbixzabbixle5.0.18
zabbix:zabbixzabbixle5.4.8
zabbix:zabbixzabbixeq6.0.0

CPE	Name	Operator	Version
zabbix:zabbix	zabbix	le	4.0.36
zabbix:zabbix	zabbix	le	5.0.18
zabbix:zabbix	zabbix	le	5.4.8
zabbix:zabbix	zabbix	eq	6.0.0

CNA Affected

[
  {
    "product": "Proxy, Server",
    "vendor": "Zabbix",
    "versions": [
      {
        "status": "affected",
        "version": "4.0.0 - 4.0.36"
      },
      {
        "status": "affected",
        "version": "5.0.0 – 5.0.18"
      },
      {
        "status": "affected",
        "version": "5.4.0 – 5.4.8"
      },
      {
        "lessThan": "5.0.19*",
        "status": "unaffected",
        "version": "5.0.19",
        "versionType": "custom"
      },
      {
        "lessThan": "5.4.9*",
        "status": "unaffected",
        "version": "5.4.9",
        "versionType": "custom"
      }
    ]
  }
]