« Volver al listado

CVE-2023-32727

Estado: ModificadaAlta (7.2)—

An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zabbix — Zabbix Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-32727",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-32727",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-07T20:37:31.853611Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@zabbix.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@zabbix.com",
      "affectedData": [
        {
          "repo": "https://git.zabbix.com/",
          "vendor": "Zabbix",
          "modules": [
            "Server"
          ],
          "product": "Zabbix",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "4.0.50",
                  "status": "unaffected"
                }
              ],
              "version": "4.0.0",
              "versionType": "git",
              "lessThanOrEqual": "4.0.49"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "5.0.39",
                  "status": "unaffected"
                }
              ],
              "version": "5.0.0 ",
              "versionType": "git",
              "lessThanOrEqual": "5.0.38"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.0.23rc1",
                  "status": "unaffected"
                }
              ],
              "version": "6.0.0",
              "versionType": "git",
              "lessThanOrEqual": "6.0.22"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.4.8rc1",
                  "status": "unaffected"
                }
              ],
              "version": "6.4.0",
              "versionType": "git",
              "lessThanOrEqual": "6.4.7"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "7.0.0alpha7",
                  "status": "unaffected"
                }
              ],
              "version": "7.0.0alpha1",
              "versionType": "git",
              "lessThanOrEqual": "7.0.0alpha6"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-18T10:15:06.937",
  "references": [
    {
      "url": "https://support.zabbix.com/browse/ZBX-23857",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@zabbix.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.zabbix.com/browse/ZBX-23857",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@zabbix.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server."
    },
    {
      "lang": "es",
      "value": "Un atacante que tiene el privilegio de configurar elementos de Zabbix puede usar la función icmpping() con un comando malicioso adicional dentro para ejecutar código arbitrario en el servidor Zabbix actual."
    }
  ],
  "lastModified": "2026-06-17T05:59:28.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7513ABE2-B8AD-4E25-8EE5-29F07902B696",
              "versionEndIncluding": "4.0.49",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBBB16D3-006C-4EBF-9C10-D25158E606DD",
              "versionEndIncluding": "5.0.38",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C79F088A-4743-4EBC-BF6F-5B7842CB21BB",
              "versionEndIncluding": "6.0.22",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C048503B-E983-455E-9D4F-F0FA6E0D32F5",
              "versionEndIncluding": "6.4.7",
              "versionStartIncluding": "6.4.0"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix_server:7.0.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DC55403-7711-4719-A309-2616586ED479"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix_server:7.0.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BB0DFCF-6ED3-4BA3-8B3F-D1F6D06A08DB"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix_server:7.0.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B17E6DD-0DA4-4002-B2D2-C16EED6C97BA"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix_server:7.0.0:alpha6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3358B565-5049-4373-9529-2F70F2F50AEC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@zabbix.com"
}