CVE-2024-22123

Katalog CVE

CVSS 2.7 · Low EPSS 0,57%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada zabbix. Skor CVSS 3.1 2.7 (Low) menurut NVD.

Deskripsi (NVD)

Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.

Rincian

Terbit di NVD

12 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

2.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.zabbix.com/browse/ZBX-25013 advisory vendor
• https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html