- Description
- An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.
- Source
- security@zabbix.com
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 7.2
- Impact score
- 5.9
- Exploitability score
- 1.2
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- Hype score
- Not currently trending
🔴 Zabbix Server, Code Injection Vulnerability, #CVE-2024-22116 (Critical) https://t.co/XDgplIw2SG
@dailycve
4 Dec 2024
55 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
1 Quote
این آسیبپذیری،باشناسه CVE-2024-22116 وامتیاز CVSS9.9، به کاربران دارای مجوز محدود امکان اجرای کد دلخواه از طریق API را میدهد. نسخههای آسیبپذیر شامل Zabbix 6.4.0 تا 6.4.15 و نسخه 7.0.0 هستند. برای رفع این آسیبپذیری، کاربران باید به نسخههای 6.4.16rc1 یا 7.0.0rc3 ارتقا دهند.
@cybernetic_cy
30 Nov 2024
31 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Zabbix Server Vulnerability Lets Attacker Execute Arbitrary Code Via Ping Script A critical security vulnerability, identified as CVE-2024-22116, has been patched in Zabbix, a popular monitoring solution. The vulnerability allowed an administrator with... https://t.co/eepEKEWDRn
@SecurityAid
11 Nov 2024
24 Impressions
1 Retweet
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6048A1B-69B0-40A5-8E50-00DECE750C58",
"versionEndIncluding": "6.4.15",
"versionStartIncluding": "6.4.9"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "93EB5757-7F98-4428-9616-C30A647A6612"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA00BDB5-433F-44E5-87AC-DA01C64B5DB3"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98C46C92-9D86-45CD-88FE-DFBB5502BB88"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B568E6DD-A6D1-4402-BB40-7DA2596A5BC8"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9C3673B-8459-4C63-8E90-724D1D42A8BB"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C9F6957-7526-4852-A579-DE556DBFAA97"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81A7A191-93DE-4C5D-963E-E8890FF7AACA"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AEE202D5-3C88-43A5-9328-FC78D0B9B8CF"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F88BFB75-7951-47D5-941F-3839E9E31FFA"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8216247E-C160-4D2C-906E-9D8CD731B5C2"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06548219-0DC3-4B5B-85D1-B1EE0FA30CD2"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D23985B-2F4D-41F6-B9D6-7B184FC7E447"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97964B9B-6A5E-4547-8886-E81B0849A876"
},
{
"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40992B5F-0D83-4D5C-9188-E84C369FF92F"
}
],
"operator": "OR"
}
]
}
]