← Back

CVE-2017-2824

nvd nist
Published: May 24, 2017Modified: May 13, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: NVD

Description

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.

Affected (23)

Products: Zabbix: Zabbix
Zabbix
1 product
Zabbix
Configuration A
23 vulnerable
Vulnerable SoftwareAffected Versions
Zabbix
Zabbix
Version 2.4.0
Zabbix
Version 2.4.0 rc1
Zabbix
Version 2.4.0 rc2
Zabbix
Version 2.4.0 rc3
Zabbix
Version 2.4.1
Zabbix
Version 2.4.1 rc1
Zabbix
Version 2.4.1 rc2
Zabbix
Version 2.4.2
Zabbix
Version 2.4.2 rc1
Zabbix
Version 2.4.3
Zabbix
Version 2.4.3 rc1
Zabbix
Version 2.4.4
Zabbix
Version 2.4.4 rc1
Zabbix
Version 2.4.5
Zabbix
Version 2.4.5 rc1
Zabbix
Version 2.4.6
Zabbix
Version 2.4.6 rc1
Zabbix
Version 2.4.7
Zabbix
Version 2.4.7 rc1
Zabbix
Version 2.4.8
Zabbix
Version 2.4.8 rc1
Zabbix
Version 2.4.9
Zabbix
Version 2.4.9 rc1

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (6)

Source: talos-cna@cisco.com
Source: talos-cna@cisco.com
Third Party AdvisoryVDB Entry
Source: talos-cna@cisco.com
ExploitMitigationThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMitigationThird Party AdvisoryVDB Entry

Timeline

No history available yet.