CVE-2024-22116: Remote code execution within ping script
First published: Fri Aug 09 2024(Updated: )
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.
Credit: security@zabbix.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zabbix Server | >=6.4.9<=6.4.15 | |
| Zabbix Server | =7.0.0-alpha1 | |
| Zabbix Server | =7.0.0-alpha2 | |
| Zabbix Server | =7.0.0-alpha3 | |
| Zabbix Server | =7.0.0-alpha4 | |
| Zabbix Server | =7.0.0-alpha5 | |
| Zabbix Server | =7.0.0-alpha6 | |
| Zabbix Server | =7.0.0-alpha7 | |
| Zabbix Server | =7.0.0-alpha8 | |
| Zabbix Server | =7.0.0-alpha9 | |
| Zabbix Server | =7.0.0-beta1 | |
| Zabbix Server | =7.0.0-beta2 | |
| Zabbix Server | =7.0.0-beta3 | |
| Zabbix Server | =7.0.0-rc1 | |
| Zabbix Server | =7.0.0-rc2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-22116?
CVE-2024-22116 has been classified as a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2024-22116?
To mitigate CVE-2024-22116, users should upgrade to Zabbix version 6.4.16 or later.
Who is affected by CVE-2024-22116?
CVE-2024-22116 affects Zabbix versions 6.4.9 to 6.4.15, as well as several 7.0.0 alpha, beta, and release candidate versions.
What is the impact of CVE-2024-22116?
The impact of CVE-2024-22116 includes unauthorized script execution leading to potential full system compromise.
Can CVE-2024-22116 be exploited remotely?
Yes, CVE-2024-22116 can be exploited remotely by an administrator with restricted permissions.
- agent/weakness
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- agent/references
- agent/last-modified-date
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/zabbix
- canonical/zabbix server
- version/zabbix server/6.4.9
- version/zabbix server/6.4.15
- version/zabbix server/7.0.0-alpha1
- version/zabbix server/7.0.0-alpha2
- version/zabbix server/7.0.0-alpha3
- version/zabbix server/7.0.0-alpha4
- version/zabbix server/7.0.0-alpha5
- version/zabbix server/7.0.0-alpha6
- version/zabbix server/7.0.0-alpha7
- version/zabbix server/7.0.0-alpha8
- version/zabbix server/7.0.0-alpha9
- version/zabbix server/7.0.0-beta1
- version/zabbix server/7.0.0-beta2
- version/zabbix server/7.0.0-beta3
- version/zabbix server/7.0.0-rc1
- version/zabbix server/7.0.0-rc2