Vulnerability Details : CVE-2022-23132
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level
Vulnerability category: BypassGain privilege
Products affected by CVE-2022-23132
- cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:6.0.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:6.0.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:6.0.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:6.0.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:6.0.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:6.0.0:alpha6:*:*:*:*:*:*
- cpe:2.3:a:zabbix:zabbix:6.0.0:alpha7:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-23132
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 25 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-23132
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
7.3
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
3.9
|
3.4
|
NIST | |
|
3.3
|
LOW | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N |
0.8
|
2.5
|
Zabbix |
CWE ids for CVE-2022-23132
-
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.Assigned by: security@zabbix.com (Secondary)
-
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-23132
-
https://support.zabbix.com/browse/ZBX-20341
[ZBX-20341] Incorrect permissions of [/var/run/zabbix] forces dac_override (CVE-2022-23132) - ZABBIX SUPPORTIssue Tracking;Patch;Vendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/
[SECURITY] Fedora 34 Update: zabbix-5.0.19-1.fc34 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/
[SECURITY] Fedora 35 Update: zabbix-5.0.19-1.fc35 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
Jump to