CVE-2024-22116

Katalog CVE

CVSS 7.2 · High EPSS 1,6%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada zabbix. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

Rincian

Terbit di NVD

12 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.zabbix.com/browse/ZBX-25016 advisory vendor
• https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html