Lucene search

Alpine Linux Development TeamALPINE:CVE-2024-22116

HistoryAug 12, 2024 - 1:38 p.m.

CVE-2024-22116

2024-08-1213:38:15

Alpine Linux Development Team

security.alpinelinux.org

administrator

monitoring hosts

ping script

code execution

infrastructure

unix

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.3

Confidence

Low

EPSS

Percentile

9.5%

JSON

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

OSVersionArchitecturePackageVersionFilename
Alpine3.20-communitynoarchzabbix= 6.4.15-r2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	3.20-community	noarch	zabbix	= 6.4.15-r2	UNKNOWN

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.3

Confidence

Low

EPSS

Percentile

9.5%

JSON

Related for ALPINE:CVE-2024-22116