Zabbix

Records145All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical24CVSS 9.0–10.0

CVSS high41CVSS 7.0–8.9

Exploited now

Zabbix records in CISA KEV

TI-2022-07300 Zabbix Frontend Authentication Bypass Vulnerability CRITICAL 100KEV 2022-02-22 TI-2022-07303 Zabbix Frontend Improper Access Control Vulnerability HIGH 81KEV 2022-02-22

Components

Products in the NVD configurations · select one to filter the records

Zabbix 115 records CRITICAL Frontend 13 records HIGH Zabbix-agent2 4 records MEDIUM Zabbix Server 2 records MEDIUM Web Service Report Generation 1 record MEDIUM Zabbix-agent 1 record LOW Zabbix Agentd 1 record LOW

Records

4 records in Zabbix-agent2 · all components

TI-2022-23126 CVE-2022-46768 · GHSA-r7ff-gv9g-75w3

File name information disclosure vulnerability in Zabbix Web Service Report Generation

MEDIUM 57

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.47772 Published 2022-12-19 Fixed in 6.0.12rc1, 6.2.6rc1 CWE-20

TI-2023-13832 CVE-2023-29453 · GHSA-7374-hfgm-rm8v

Agent 2 package are built with Go version affected by CVE-2023-24538

MEDIUM 51

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00897 Published 2023-10-12 No fix listed CWE-94

TI-2022-06957 CVE-2022-22704 · GHSA-rgf9-28hg-x4c8

The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege…

MEDIUM 45

The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd would (in effect) determine part of the configuration.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01378 Published 2022-01-06 No fix listed CWE-909

TI-2023-15997 CVE-2023-32728 · GHSA-c26q-v9gv-jx6m

Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin

MEDIUM 43

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00753 Published 2023-12-18 No fix listed CWE-20

Open these records in search →

Critical	24
High	41
Medium	63
Low	17
No CVSS	0