7.2

CVE-2021-46088

Exploit

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.

Data is provided by the National Vulnerability Database (NVD)
Zabbix ≫ Zabbix Version >= 4.0.0 <= 4.0.34
Zabbix ≫ Zabbix Version >= 4.2.0 <= 4.2.8
Zabbix ≫ Zabbix Version >= 4.4.0 <= 4.4.11
Zabbix ≫ Zabbix Version >= 5.0.0 <= 5.0.20
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 2.97% 0.852
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
https://github.com/paalbra/zabbix-zbxsec-7
Third Party Advisory
Exploit