Evil-DB LogoEvil-DB
← All CVEs

CVE-2016-4338

high · 8.1

The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter.

8.1
CVSS
21.1%
EPSS (exploit prob.)
97th
EPSS percentile
2017-01-23
Published

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

VendorProductAffected versions
zabbixzabbix2.0.0
zabbixzabbix2.0.1
zabbixzabbix2.0.2
zabbixzabbix2.0.3
zabbixzabbix2.0.4
zabbixzabbix2.0.5
zabbixzabbix2.0.6
zabbixzabbix2.0.7
zabbixzabbix2.0.8
zabbixzabbix2.0.9
zabbixzabbix2.0.10
zabbixzabbix2.0.11
zabbixzabbix2.0.12
zabbixzabbix2.0.13
zabbixzabbix2.0.14
zabbixzabbix2.0.15
zabbixzabbix2.0.16
zabbixzabbix2.0.17
zabbixzabbix2.2.0
zabbixzabbix2.2.1
zabbixzabbix2.2.2
zabbixzabbix2.2.3
zabbixzabbix2.2.4
zabbixzabbix2.2.5
zabbixzabbix2.2.6
zabbixzabbix2.2.7
zabbixzabbix2.2.8
zabbixzabbix2.2.9
zabbixzabbix2.2.10
zabbixzabbix2.2.11
zabbixzabbix2.2.12
zabbixzabbix3.0.0
zabbixzabbix3.0.2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-4338