by Kastro
Paper/Archive/CVE-2023-32722

CVE-2023-32722

Zabbix Zabbix — Stack-buffer Overflow in library module zbxjson

EPSS 0.8%CVSS 9.6
critical.is priorityof 100
40
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 56.6.566 × 2011.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.

Affected

ProductAffectedFixed inSource
Zabbix6.0.0 – 6.0.20–CNA
Zabbix6.4.0 – 6.4.5–CNA
Zabbix7.0.0alpha1 – 7.0.0alpha3–CNA
zabbix6.0.0 – 6.0.20–CISA-ADP
zabbix6.4.0 – 6.4.5–CISA-ADP
zabbix7.0.0–CISA-ADP

Scores by source

Zabbix (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.zabbix.com/browse/ZBX-23390reflists.debian.org/debian-lts-announce/2024/10/msg00000.html