CVE-2024-22123 — Code Injection in Zabbix

CWE-94 — Code Injection4 documents4 sources
Severity
2.7LOWNVD
EPSS
0.4%
top 39.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ZabbixDebian Zabbix
Timeline
PublishedAug 12

Description

Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NExploitability: 1.2 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/zabbix< zabbix 1:5.0.44+dfsg-1+deb11u1 (bullseye)
▶Debianzabbix/zabbix< 1:5.0.44+dfsg-1+deb11u1+2
▶CVEListV5zabbix/zabbix7.0.0alpha1 — 7.0.0rc2
▶NVDzabbix/zabbix5.0.0 — 5.0.42+3

🔴Vulnerability Details

2
OSV
CVE-2024-22123: Setting SMS media allows to set GSM modem file↗2024-08-12
▶
GHSA
GHSA-qxrq-fp7f-qqh5: Setting SMS media allows to set GSM modem file↗2024-08-12
▶

📋Vendor Advisories

1
Debian
CVE-2024-22123: zabbix - Setting SMS media allows to set GSM modem file. Later this file is used as Linux...↗2024
▶