PT-2023-7987 · Zabbix+4 · Zabbix+4

Alexander Vladishev · Published 2023-02-23 · Updated 2024-12-10 · CVE-2023-29450

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zabbix (affected versions not specified)

Description The issue is related to the use of files and directories accessible to external parties, potentially allowing a remote attacker to gain read-only access to the file system on behalf of the user "zabbix" on the Zabbix Server or Zabbix Proxy. This could lead to unauthorized access to sensitive data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Files Accessible to External Parties

Weakness Enumeration

CWE-200

CWE-552

Related Identifiers

ALT-PU-2023-6268

BDU:2023-09101

CVE-2023-29450

DLA-3538-1

DLA-3538-2

DLA-3909-1

ROSA-SA-2024-2539

SUSE-SU-2023:3029-1

SUSE-SU-2023_3029-1

Affected Products

Alt Linux

Astra Linux

Debian

Suse

Zabbix

References · 122

• 🔥 https://github.com/K3ysTr0K3R/CVE-2019-17382-EXPLOIT · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-29451 · Security Note
• https://bdu.fstec.ru/vul/2023-01720 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29450 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22119 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23133 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-35230 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35230 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=158612043 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00033 · Security Note
• https://bdu.fstec.ru/vul/2023-09070 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-29450 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24917 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-29450 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01712 · Security Note