CVE-2022-23132: fedoraproject fedora Improper Access Control
CVSS: 7.5v2.0HighModified
AliasesUBUNTU-CVE-2022-23132DEBIAN-CVE-2022-23132
Published 13-01-2022Last modified 03-11-2025
Vulnerability summary
CVE-2022-23132 is a high (CVSS 7.5) Improper Access Control vulnerability in fedoraproject fedora. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.6% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v2.0 (NVD)EPSS score
0.80%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 13-01-2022PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level
CVSS metrics
5 scores · 4 sources · 2 versionsLow 3.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:NSources4 sources · 3.3–7.3
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
- NVDNIST7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.80% on 19-09-2026
19-09-202619-10-2026
EPSS score0.80%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Zabbix2 products
- proxy, server4.0.0 - 4.0.36 | 5.0.0 – 5.0.18 | 5.4.0 – 5.4.8
- zabbix≥ 4.0.0, ≤ 4.0.36 | ≥ 5.0.0, ≤ 5.0.18 | ≥ 5.4.0, ≤ 5.4.8 | 6.0.0:alpha1 | 6.0.0:alpha2 | 6.0.0:alpha3 | 6.0.0:alpha4 | 6.0.0:alpha5 | 6.0.0:alpha6 | 6.0.0:alpha7
Debian1 product
- zabbix< 1:6.0.7+dfsg-2
Fedoraproject1 product
- fedoraEOL34 | 35
Ubuntu1 product
- zabbixAll versions (No fix recorded)
4 vendors · 5 products
