CVE-2024-22116

Name

CVE-2024-22116

Description

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

NVD Severity

high

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

CPE URI	Source package	Min version	Max version
	zabbix	>= 6.4.0	<= 6.4.15
	zabbix	>= 7.0.0alpha1	<= 7.0.0rc2
`cpe:2.3:a:zabbix:zabbix::::::::`	zabbix	>= 6.4.0	<= 6.4.15
`cpe:2.3:a:zabbix:zabbix::::::::`	zabbix	>= 7.0.0alpha1	<= 7.0.0rc2

References

Match rules

Vulnerable and fixed packages