CVE-2023-32728 — Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin

CVE-2023-32728

Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin PUBLISHED

Description (CNA)

The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 5,0,0 through 5.0.38; affected 6.0.0 through 6.0.23; affected 6.4.0 through 6.4.8; affected 7.0.0alpha1 through 7.0.0alpha7

CWE

CWE-20

References

https://support.zabbix.com/browse/ZBX-23858

ADP enrichment

CVE

No English description supplied.

https://support.zabbix.com/browse/ZBX-23858

CISA-ADP

No English description supplied.

No references supplied.