CVE-2024-22116

2024-08-1213:38:15

CWE-94

Zabbix

web.nvd.nist.gov

cve-2024-22116

administrator

restricted permissions

exploit

script execution

lack of default escaping

arbitrary code

ping script

compromising infrastructure

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

Percentile

9.5%

JSON

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Server"
    ],
    "product": "Zabbix",
    "repo": "https://git.zabbix.com/",
    "vendor": "Zabbix",
    "versions": [
      {
        "changes": [
          {
            "at": "6.4.16rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.4.15",
        "status": "affected",
        "version": "6.4.9",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "7.0.0rc3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "7.0.0rc2",
        "status": "affected",
        "version": "7.0.0alpha1",
        "versionType": "git"
      }
    ]
  }
]