Skip to content
CVE PROGRAM SOURCE RECORD3.3 Low

CVE-2022-23132

Incorrect permissions of [/var/run/zabbix] forces dac_override

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zabbix

Description

During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zabbix Proxy, Server

  • 4.0.0 - 4.0.36affected
  • 5.0.0 – 5.0.18affected
  • 5.4.0 – 5.4.8affected
  • 5.0.19 to < 5.0.19*unaffected
  • 5.4.9 to < 5.4.9*unaffected

References