CVE-2024-22116

published 2024-08-12

CVE-2024-22116: An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping…

Priority P3 46 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	zabbix	< zabbix 1:5.0.44+dfsg-1+deb11u1 (bullseye)	zabbix 1:5.0.44+dfsg-1+deb11u1 (bullseye)
zabbix	zabbix	—	—
zabbix	zabbix	>= 0 < 1:5.0.44+dfsg-1+deb11u1	1:5.0.44+dfsg-1+deb11u1
zabbix	zabbix	>= 0 < 1:7.0.0+dfsg-1	1:7.0.0+dfsg-1
zabbix	zabbix	>= 0 < 1:7.0.0+dfsg-1	1:7.0.0+dfsg-1
zabbix	zabbix	6.4.9 – 6.4.15	—
zabbix	zabbix	7.0.0alpha1 – 7.0.0rc2	—

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

osv 7.2 HIGH

vendor_debian 9.9 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94