2.7

CVE-2024-22123

Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.

Data is provided by the National Vulnerability Database (NVD)
Zabbix ≫ Zabbix Version >= 5.0.0 <= 5.0.42
Zabbix ≫ Zabbix Version >= 6.0.0 <= 6.0.30
Zabbix ≫ Zabbix Version >= 6.4.0 <= 6.4.15
Zabbix ≫ Zabbix Version7.0.0 Updatealpha1
Zabbix ≫ Zabbix Version7.0.0 Updatealpha2
Zabbix ≫ Zabbix Version7.0.0 Updatealpha3
Zabbix ≫ Zabbix Version7.0.0 Updatealpha4
Zabbix ≫ Zabbix Version7.0.0 Updatealpha5
Zabbix ≫ Zabbix Version7.0.0 Updatealpha6
Zabbix ≫ Zabbix Version7.0.0 Updatealpha7
Zabbix ≫ Zabbix Version7.0.0 Updatealpha8
Zabbix ≫ Zabbix Version7.0.0 Updatealpha9
Zabbix ≫ Zabbix Version7.0.0 Updatebeta1
Zabbix ≫ Zabbix Version7.0.0 Updatebeta2
Zabbix ≫ Zabbix Version7.0.0 Updatebeta3
Zabbix ≫ Zabbix Version7.0.0 Updaterc1
Zabbix ≫ Zabbix Version7.0.0 Updaterc2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.3% 0.527
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
security@zabbix.com 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.