2.7

CVE-2024-22123

Zabbix Arbitrary File Read

Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zabbix ≫ Zabbix Version >= 5.0.0 <= 5.0.42
Zabbix ≫ Zabbix Version >= 6.0.0 <= 6.0.30
Zabbix ≫ Zabbix Version >= 6.4.0 <= 6.4.15
Zabbix ≫ Zabbix Version 7.0.0 Update alpha1
Zabbix ≫ Zabbix Version 7.0.0 Update alpha2
Zabbix ≫ Zabbix Version 7.0.0 Update alpha3
Zabbix ≫ Zabbix Version 7.0.0 Update alpha4
Zabbix ≫ Zabbix Version 7.0.0 Update alpha5
Zabbix ≫ Zabbix Version 7.0.0 Update alpha6
Zabbix ≫ Zabbix Version 7.0.0 Update alpha7
Zabbix ≫ Zabbix Version 7.0.0 Update alpha8
Zabbix ≫ Zabbix Version 7.0.0 Update alpha9
Zabbix ≫ Zabbix Version 7.0.0 Update beta1
Zabbix ≫ Zabbix Version 7.0.0 Update beta2
Zabbix ≫ Zabbix Version 7.0.0 Update beta3
Zabbix ≫ Zabbix Version 7.0.0 Update rc1
Zabbix ≫ Zabbix Version 7.0.0 Update rc2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.428
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
security@zabbix.com 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://support.zabbix.com/browse/ZBX-25013
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html