CVE-2023-32727
Fixed in a distro release EPSS <1%CVSS 6.8
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
Products: Zabbix
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | zabbix | 1:5.0.44+dfsg-1+deb11u1 |
| Debian 12 | zabbix | no fix |
| Debian 13 | zabbix | 1:6.0.23+dfsg-1 |
| Debian 14 | zabbix | 1:6.0.23+dfsg-1 |
| SUSE Package Hub 15 SP4 | zabbix | 4.0.50-bp154.2.9.1 |
| SUSE Package Hub 15 SP5 | zabbix | 4.0.50-bp155.3.9.1 |
| Ubuntu Pro 20.04 LTS | zabbix | no fix |
| Ubuntu Pro 22.04 LTS | zabbix | no fix |
| openSUSE Leap 15.4 | zabbix | 4.0.50-bp154.2.9.1 |
| openSUSE Leap 15.5 | zabbix | 4.0.50-bp155.3.9.1 |
| openSUSE Tumbleweed | zabbix | 6.0.25-1.1 |