CVE-2022-23132

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-231335.4An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS isCVE-2022-231345.3After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users aCVE-2022-231356.5There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destinatCVE-2022-231365.4There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters aCVE-2022-231376.1ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and whCVE-2022-231387.5ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, anCVE-2022-231398.8ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconCVE-2022-23149.8The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.CVE-2022-231417.5ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it isCVE-2022-231425.3ZXEN CG200 has a DoS vulnerability. An attacker could construct and send a large number of HTTP GET requests in a short time, which can makeCVE-2022-231436.5ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high peCVE-2022-231449.1There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerabi
CVE-2022-23132: High severity, CVSS 7.3 | Vulnix