Bug 2047748 (CVE-2021-46088) - CVE-2021-46088 zabbix: admin users can perform remote code execution in the application user context
Summary: CVE-2021-46088 zabbix: admin users can perform remote code execution in the a...
Keywords:
Status: NEW
Alias: CVE-2021-46088
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2047749
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-01-28 13:13 UTC by Sandipan Roy
Modified: 2023-07-07 08:28 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Sandipan Roy 2022-01-28 13:13:26 UTC 
Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.

https://github.com/paalbra/zabbix-zbxsec-7
Comment 1 Sandipan Roy 2022-01-28 13:13:47 UTC 
Created zabbix tracking bugs for this issue:

Affects: fedora-all [bug 2047749]
Note You need to log in before you can comment on or make changes to this bug.