CVE-2023-32722

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120CWE-787

Affected software

VendorProductVersions
ZabbixZabbix>= 6.0.0, <= 6.0.20; >= 6.4.0, <= 6.4.5; >= 7.0.0alpha1, <= 7.0.0alpha3
zabbixzabbix>= 6.0.0, <= 6.0.20; >= 6.4.0, <= 6.4.5
zabbixzabbix7.0.0

References

Timeline

Published
Oct 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-327239.1Request to LDAP is sent before user permissions are checked.CVE-2023-327248.8Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulatCVE-2023-327258.8The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cooCVE-2023-327268.1The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.CVE-2023-327277.2An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execuCVE-2023-327289.8The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerCVE-2023-32737.5Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by chanCVE-2023-327317.5When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutatCVE-2023-327325.3gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encodCVE-2023-327347.8The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, watchCVE-2023-327356.5A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V1CVE-2023-327367.3A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16
CVE-2023-32722: High severity, CVSS 7.8 | Vulnix