CVE-2013-6824

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://security.gentoo.org/glsa/glsa-201401-26.xml
http://www.zabbix.com/rn1.8.19rc1.phpPatch, Vendor Advisory
http://www.zabbix.com/rn2.0.10rc1.phpPatch, Vendor Advisory
http://www.zabbix.com/rn2.2.1rc1.phpPatch, Vendor Advisory
https://support.zabbix.com/browse/ZBX-7479Exploit, Patch
http://security.gentoo.org/glsa/glsa-201401-26.xml
http://www.zabbix.com/rn1.8.19rc1.phpPatch, Vendor Advisory
http://www.zabbix.com/rn2.0.10rc1.phpPatch, Vendor Advisory
http://www.zabbix.com/rn2.2.1rc1.phpPatch, Vendor Advisory
https://support.zabbix.com/browse/ZBX-7479Exploit, Patch

Timeline

Published: Dec 19, 2013
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-68257.2(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrc CVE-2013-68266.8cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token paramet CVE-2013-68275.0Absolute path traversal vulnerability in admin/viewmsg.php in PineApp Mail-SeCure allows remote attackers to read arbitrary files via a full CVE-2013-68286.4admin/management.html in PineApp Mail-SeCure allows remote attackers to bypass authentication and perform a sys_usermng operation via the it CVE-2013-68297.5admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pingh CVE-2013-68307.5admin/confnetworking.html in PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms allows remote attackers to execute arbitra CVE-2013-68317.2PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms has a sudoers file that does not properly restrict user specifications,CVE-2013-68324.9The nand_ioctl function in sys/dev/nand/nand_geom.c in the nand driver in the kernel in FreeBSD 10 and earlier does not properly initialize CVE-2013-68334.9The qls_eioctl function in sys/dev/qlxge/qls_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, whi CVE-2013-68344.9The ql_eioctl function in sys/dev/qlxgbe/ql_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, whic CVE-2013-68355.0TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which all CVE-2013-68364.3Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows rem