Bug 2281599 (CVE-2024-22120) - CVE-2024-22120 zabbix: command execution for configured scripts
Summary: CVE-2024-22120 zabbix: command execution for configured scripts
Keywords:
Status: NEW
Alias: CVE-2024-22120
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2281600 2281601 2281602 2281603
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-05-20 07:28 UTC by ybuenos
Modified: 2024-05-20 07:29 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description ybuenos 2024-05-20 07:28:34 UTC 
Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

https://support.zabbix.com/browse/ZBX-24505
Comment 1 ybuenos 2024-05-20 07:29:03 UTC 
Created zabbix tracking bugs for this issue:

Affects: epel-all [bug 2281601]
Affects: fedora-all [bug 2281600]


Created zabbix40 tracking bugs for this issue:

Affects: epel-all [bug 2281602]


Created zabbix50 tracking bugs for this issue:

Affects: epel-7 [bug 2281603]
Note You need to log in before you can comment on or make changes to this bug.