by Kastro
Paper/Archive/CVE-2023-32728

CVE-2023-32728

Zabbix Zabbix — Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.1.551 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.

Affected

ProductAffectedFixed inSource
Zabbix5,0,0 – 5.0.38–CNA
Zabbix6.0.0 – 6.0.23–CNA
Zabbix6.4.0 – 6.4.8 –CNA
Zabbix7.0.0alpha1 – 7.0.0alpha7 –CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Zabbix (CNA)4.6CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsupport.zabbix.com/browse/ZBX-23858