Lucene search

[email protected]CVE-2023-32728

HistoryDec 18, 2023 - 10:15 a.m.

CVE-2023-32728

2023-12-1810:15:07

CWE-94

CWE-20

[email protected]

web.nvd.nist.gov

zabbix

agent 2

smart.disk.get

vulnerability

remote code execution

cve-2023-32728

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.9%

JSON

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.

Affected configurations

NVD

Node

zabbixzabbix-agent2Range5.0.0–5.0.38

zabbixzabbix-agent2Range6.0.0–6.0.23

zabbixzabbix-agent2Range6.4.0–6.4.8

zabbixzabbix-agent2Match7.0.0alpha1

zabbixzabbix-agent2Match7.0.0alpha2

zabbixzabbix-agent2Match7.0.0alpha3

zabbixzabbix-agent2Match7.0.0alpha6

zabbixzabbix-agent2Match7.0.0alpha7

CPENameOperatorVersion
zabbix:zabbix-agent2zabbix zabbix-agent2le5.0.38
zabbix:zabbix-agent2zabbix zabbix-agent2le6.0.23
zabbix:zabbix-agent2zabbix zabbix-agent2le6.4.8
zabbix:zabbix-agent2zabbix zabbix-agent2eq7.0.0

CPE	Name	Operator	Version
zabbix:zabbix-agent2	zabbix zabbix-agent2	le	5.0.38
zabbix:zabbix-agent2	zabbix zabbix-agent2	le	6.0.23
zabbix:zabbix-agent2	zabbix zabbix-agent2	le	6.4.8
zabbix:zabbix-agent2	zabbix zabbix-agent2	eq	7.0.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Agent 2"
    ],
    "product": "Zabbix",
    "repo": "https://git.zabbix.com/",
    "vendor": "Zabbix",
    "versions": [
      {
        "changes": [
          {
            "at": "5.0.39rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "5.0.38",
        "status": "affected",
        "version": "5,0,0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.0.24rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.0.23",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.4.9rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.4.8 ",
        "status": "affected",
        "version": "6.4.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "7.0.0alpha8",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "7.0.0alpha7 ",
        "status": "affected",
        "version": "7.0.0alpha1",
        "versionType": "git"
      }
    ]
  }
]