CVE-2024-22116: Remote code execution within ping script
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22116?
CVE-2024-22116 has been classified as a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2024-22116?
To mitigate CVE-2024-22116, users should upgrade to Zabbix version 6.4.16 or later.
Who is affected by CVE-2024-22116?
CVE-2024-22116 affects Zabbix versions 6.4.9 to 6.4.15, as well as several 7.0.0 alpha, beta, and release candidate versions.
What is the impact of CVE-2024-22116?
The impact of CVE-2024-22116 includes unauthorized script execution leading to potential full system compromise.
Can CVE-2024-22116 be exploited remotely?
Yes, CVE-2024-22116 can be exploited remotely by an administrator with restricted permissions.