CVE-2009-4498
NoneCVSS
—
EPSS
31.9%
Published
Dec 31, 2009
CISA due date
—
The record
The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | zabbix | 0 | 1:1.8-1 |
| Debian:12 | zabbix | 0 | 1:1.8-1 |
| Debian:13 | zabbix | 0 | 1:1.8-1 |
Related vulnerabilities
- CVE-2024-36465 A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability… Also affects zabbix
- CVE-2024-36464 When exporting media types, the password is exported in the YAML in plain text. Also affects zabbix
- CVE-2024-42330 The HttpRequest object allows to get the HTTP headers from the server's response after… Also affects zabbix
- CVE-2024-42333 The researcher is showing that it is possible to leak a small amount of Zabbix Server… Also affects zabbix
- CVE-2024-42332 The researcher is showing that due to the way the SNMP trap log is parsed, an attacker… Also affects zabbix
- CVE-2024-42331 In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap… Also affects zabbix
- CVE-2024-36467 An authenticated user with API access (e.g.: user with default User role), more… Also affects zabbix
- CVE-2024-22117 When a URL is added to the map element, it is recorded in the database with sequential… Also affects zabbix