PT-2023-7987 · Zabbix+4 · Zabbix+4

Alexander Vladishev · Publicado 2023-02-23 · Atualizado 2024-12-10 · CVE-2023-29450

Positive Technologies (AI Summary)

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zabbix (affected versions not specified)

Description The issue is related to the use of files and directories accessible to external parties, potentially allowing a remote attacker to gain read-only access to the file system on behalf of the user "zabbix" on the Zabbix Server or Zabbix Proxy. This could lead to unauthorized access to sensitive data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Files Accessible to External Parties

Enumeração de Fraquezas

CWE-200

CWE-552

Identificadores relacionados

ALT-PU-2023-6268

BDU:2023-09101

CVE-2023-29450

DLA-3538-1

DLA-3538-2

DLA-3909-1

ROSA-SA-2024-2539

SUSE-SU-2023:3029-1

SUSE-SU-2023_3029-1

Produtos afetados

Alt Linux

Astra Linux

Debian

Suse

Zabbix

Referências · 122

• 🔥 https://github.com/K3ysTr0K3R/CVE-2019-17382-EXPLOIT · Exploit
• https://github.com/zabbix/zabbix/commit/c3f1543e4 · Nota
• https://github.com/zabbix/zabbix/commit/76f6a80cb · Nota
• https://github.com/paalbra/zabbix-zbxsec-7 · Nota
• https://bugzilla.suse.com/1213307 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-29451 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-01720 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-29450 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22119 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23133 · Nota de Segurança
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.11 · Nota
• https://suse.com/security/cve/CVE-2023-29450 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-35230 · Nota de Segurança
• https://bugzilla.suse.com/show_bug.cgi?id=1213307 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35230 · Nota de Segurança