8.8

CVE-2024-22120

Exploit

Time Based SQL Injection in Zabbix Server Audit Log

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zabbix ≫ Zabbix Version >= 6.0.0 < 6.0.28
Zabbix ≫ Zabbix Version >= 6.4.0 < 6.4.13
Zabbix ≫ Zabbix Version 7.0.0 Update alpha1
Zabbix ≫ Zabbix Version 7.0.0 Update alpha2
Zabbix ≫ Zabbix Version 7.0.0 Update alpha3
Zabbix ≫ Zabbix Version 7.0.0 Update alpha4
Zabbix ≫ Zabbix Version 7.0.0 Update alpha5
Zabbix ≫ Zabbix Version 7.0.0 Update alpha6
Zabbix ≫ Zabbix Version 7.0.0 Update alpha7
Zabbix ≫ Zabbix Version 7.0.0 Update alpha8
Zabbix ≫ Zabbix Version 7.0.0 Update alpha9
Zabbix ≫ Zabbix Version 7.0.0 Update beta1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 76.62% 0.995
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@zabbix.com 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://support.zabbix.com/browse/ZBX-24505
Vendor Advisory
Exploit