PT-2022-7424 · Zabbix · Zabbix-Agent2

Published 2022-01-06 · Updated 2023-08-08 · CVE-2022-22704

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions zabbix-agent2 versions prior to 5.4.9-r1

Description The issue is related to a design flaw in the zabbix-agent2 package for Alpine Linux, where it incorrectly relies on systemd to determine part of the configuration, leading to a potential privilege escalation to root level for a remote attacker.

Recommendations For versions prior to 5.4.9-r1, update to version 5.4.9-r1 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-909

Related Identifiers

BDU:2024-05974

CVE-2022-22704

Affected Products

Zabbix-Agent2

References · 12

• 🔥 https://gitlab.alpinelinux.org/alpine/aports/-/issues/13368 · Exploit
• https://osv.dev/vulnerability/CVE-2022-22704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22704 · Security Note
• https://bdu.fstec.ru/vul/2024-05974 · Security Note
• https://t.me/cvenotify/25011 · Telegram Post
• https://cvefeed.io/vuln/detail/CVE-2022-22704 · Note
• https://t.me/cvenotify/26077 · Telegram Post
• https://t.me/cibsecurity/35019 · Telegram Post
• https://opencve.io/cve/CVE-2022-22704 · Note
• https://cxsecurity.com/cveshow/CVE-2022-22704 · Note
• https://secalerts.co/vulnerability/CVE-2022-22704 · Note
• https://t.me/cvenotify/25437 · Telegram Post