CVE-2022-23132

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-732

Affected software

Vendor	Product	Versions
Zabbix	Proxy, Server	4.0.0 - 4.0.36; 5.0.0 – 5.0.18; 5.4.0 – 5.4.8

References

Timeline

Published: Jan 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-231335.4An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is CVE-2022-231345.3After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users a CVE-2022-231356.5There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destinat CVE-2022-231365.4There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters a CVE-2022-231376.1ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and wh CVE-2022-231387.5ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, an CVE-2022-231398.8ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is incon CVE-2022-23149.8The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.CVE-2022-231417.5ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is CVE-2022-231425.3ZXEN CG200 has a DoS vulnerability. An attacker could construct and send a large number of HTTP GET requests in a short time, which can make CVE-2022-231436.5ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high pe CVE-2022-231449.1There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerabi