7.2

CVE-2024-22116

Remote code execution within ping script

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zabbix ≫ Zabbix Version >= 6.4.9 <= 6.4.15
Zabbix ≫ Zabbix Version 7.0.0 Update alpha1
Zabbix ≫ Zabbix Version 7.0.0 Update alpha2
Zabbix ≫ Zabbix Version 7.0.0 Update alpha3
Zabbix ≫ Zabbix Version 7.0.0 Update alpha4
Zabbix ≫ Zabbix Version 7.0.0 Update alpha5
Zabbix ≫ Zabbix Version 7.0.0 Update alpha6
Zabbix ≫ Zabbix Version 7.0.0 Update alpha7
Zabbix ≫ Zabbix Version 7.0.0 Update alpha8
Zabbix ≫ Zabbix Version 7.0.0 Update alpha9
Zabbix ≫ Zabbix Version 7.0.0 Update beta1
Zabbix ≫ Zabbix Version 7.0.0 Update beta2
Zabbix ≫ Zabbix Version 7.0.0 Update beta3
Zabbix ≫ Zabbix Version 7.0.0 Update rc1
Zabbix ≫ Zabbix Version 7.0.0 Update rc2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.6% 0.727
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
security@zabbix.com 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://support.zabbix.com/browse/ZBX-25016
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html