GSD-2022-43516

Vulnerability from gsd - Updated: 2023-12-13 01:19
Details
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)
Aliases
Aliases
CVE-2022-43516
To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-43516",
    "id": "GSD-2022-43516",
    "references": [
      "https://www.suse.com/security/cve/CVE-2022-43516.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-43516"
      ],
      "details": "A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)",
      "id": "GSD-2022-43516",
      "modified": "2023-12-13T01:19:32.321882Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "AKA": "ZBV-2022-12-1",
        "ASSIGNER": "security@zabbix.com",
        "DATE_PUBLIC": "2022-11-30T10:27:00.000Z",
        "ID": "CVE-2022-43516",
        "STATE": "PUBLIC",
        "TITLE": "Zabbix Agent installer adds \u201callow all TCP any any\u201d firewall rule"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Zabbix agent (MSI packages)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "Oct. 29, 2022 - Dec 2, 2022"
                        },
                        {
                          "version_affected": "!\u003e=",
                          "version_value": "Dec 3, 2022"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Zabbix agent 2 (MSI packages)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "Oct. 29, 2022 - Dec 2, 2022"
                        },
                        {
                          "version_affected": "!\u003e=",
                          "version_value": "Dec 3, 2022"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Zabbix"
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "Joshua PowellNishiyama"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-16 Configuration"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://support.zabbix.com/browse/ZBX-22002",
            "refsource": "MISC",
            "url": "https://support.zabbix.com/browse/ZBX-22002"
          }
        ]
      },
      "solution": [
        {
          "lang": "eng",
          "value": "To remediate this vulnerability, apply the updates listed in the \u0027Unaffected\u0027 section to appropriate products or use the workaround"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "work_around": [
        {
          "lang": "eng",
          "value": "If an immediate update is not possible, change the applied local firewall rule to allow the agent port only."
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:zabbix:zabbix:6.2.6:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zabbix:zabbix:6.0.12:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.2.6",
                "versionStartIncluding": "6.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.0.12",
                "versionStartIncluding": "6.0.10",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:windows_firewall:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@zabbix.com",
          "ID": "CVE-2022-43516"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.zabbix.com/browse/ZBX-22002",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://support.zabbix.com/browse/ZBX-22002"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-12-07T17:23Z",
      "publishedDate": "2022-12-05T20:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.