CVE-2016-4338

PoC ×4—

CVSS 3.0

8.1 high

EPSS

21%p97

Published

Jan 23, 2017 (Jan 23, 2017)

Modified

Jun 17, 2026

Description

The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter.

Vendors: zabbix
Products: zabbix
Weakness: CWE-89
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (21.1%)

In the news0 stories

No ingested article mentions this CVE yet.