CVE-2013-6824 Command injection in n/a
Remote attackers can execute arbitrary commands on Zabbix servers via newline injection in flexible user parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-6824?
CVE-2013-6824 is a high-severity command injection vulnerability in Zabbix Zabbix, published on 19 Dec 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter.
Weakness: CWE-94
Which versions are affected by CVE-2013-6824?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2013-6824?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2013-6824 being exploited?
There is no known exploitation of CVE-2013-6824 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2013-6824, GHSA-fvmr-q9wm-2vfr.