CVE-2023-32728

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-94

Affected software

Vendor	Product	Versions
Zabbix	Zabbix	>= 5,0,0, <= 5.0.38; >= 6.0.0, <= 6.0.23; >= 6.4.0, <= 6.4.8 ; >= 7.0.0alpha1, <= 7.0.0alpha7

References

https://support.zabbix.com/browse/ZBX-23858Vendor Advisory
https://support.zabbix.com/browse/ZBX-23858Vendor Advisory

Timeline

Published: Dec 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-32737.5Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by chan CVE-2023-327317.5When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutat CVE-2023-327325.3gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encod CVE-2023-327347.8The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, watch CVE-2023-327356.5A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V1 CVE-2023-327367.3A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 CVE-2023-327376.3A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restri CVE-2023-327384.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alkaweb Eonet Manual User Approve plugin <= 2.1.3 versions.CVE-2023-327398.8Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions.CVE-2023-32748.8A vulnerability classified as critical has been found in code-projects Supplier Management System 1.0. Affected is an unknown function of th CVE-2023-327406.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions.CVE-2023-327417.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form