Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect permissions of [/var/run/zabbix] forces dac_override
Vulnerability Description
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Vulnerability Type
访问控制不恰当
Vulnerability Title
Zabbix Sia Zabbix 安全漏洞
Vulnerability Description
Zabbix Sia Zabbix是拉脱维亚Zabbix SIA（Zabbix Sia）公司的一套开源的监控系统。该系统支持网络监控、服务器监控、云监控和应用监控等。 Zabbix 存在安全漏洞，该漏洞源于在从 RPM 安装 Zabbix 期间，DAC_OVERRIDE SELinux 功能用于访问[/var/run/zabbix]文件夹中的 PID 文件。在这种情况下，Zabbix Proxy 或 Server 进程可以绕过文件系统级别的文件读取、写入和执行权限检查。
CVSS Information
N/A
Vulnerability Type
N/A