« Volver al listado

CVE-2022-23132

Estado: ModificadaAlta (7.3)—

Durante la instalación de Zabbix desde RPM, es usada la capacidad DAC_OVERRIDE SELinux para acceder a los archivos PID en la carpeta [/var/run/zabbix]. En este caso, los procesos del proxy o del servidor de Zabbix pueden omitir la comprobación de los permisos de lectura, escritura y ejecución de los archivos en el nivel del sistema de archivos

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Fedoraproject — FedoraZabbix — Zabbix

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-23132",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@zabbix.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 0.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@zabbix.com",
      "affectedData": [
        {
          "vendor": "Zabbix",
          "product": "Proxy, Server",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0 - 4.0.36"
            },
            {
              "status": "affected",
              "version": "5.0.0 – 5.0.18"
            },
            {
              "status": "affected",
              "version": "5.4.0 – 5.4.8"
            },
            {
              "status": "unaffected",
              "version": "5.0.19",
              "lessThan": "5.0.19*",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "5.4.9",
              "lessThan": "5.4.9*",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-13T16:15:08.113",
  "references": [
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/",
      "source": "security@zabbix.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/",
      "source": "security@zabbix.com"
    },
    {
      "url": "https://support.zabbix.com/browse/ZBX-20341",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@zabbix.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.zabbix.com/browse/ZBX-20341",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@zabbix.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level"
    },
    {
      "lang": "es",
      "value": "Durante la instalación de Zabbix desde RPM, es usada la capacidad DAC_OVERRIDE SELinux para acceder a los archivos PID en la carpeta [/var/run/zabbix]. En este caso, los procesos del proxy o del servidor de Zabbix pueden omitir la comprobación de los permisos de lectura, escritura y ejecución de los archivos en el nivel del sistema de archivos"
    }
  ],
  "lastModified": "2026-06-17T04:29:34.287",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "285CF526-ACA1-438C-98FA-BEB4365E6531",
              "versionEndIncluding": "4.0.36",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5754717-C846-47CA-81C2-D2BA46BED5AD",
              "versionEndIncluding": "5.0.18",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19429F9A-8623-4BA9-984B-4982418C21CD",
              "versionEndIncluding": "5.4.8",
              "versionStartIncluding": "5.4.0"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:6.0.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DC67B03-AF43-45C9-8EAC-D60DA5887712"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:6.0.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C483257-D279-4A20-8451-1C2D34AF8C7D"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:6.0.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9B37226-5339-4B5E-B515-BBC5D95A122D"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:6.0.0:alpha4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69B35CCA-9F00-4FED-B2F6-3A561369AF44"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:6.0.0:alpha5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4270E53E-563E-4B60-9C19-5E8E78635B86"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:6.0.0:alpha6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7BCC855-4C6A-4E00-BA2A-3CAD738DF49D"
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:6.0.0:alpha7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5EE65D8-BD54-491F-8B61-A58D57C2D1CA"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@zabbix.com"
}