fkie_cve-2024-22120
Vulnerability from fkie_nvd
Published
2024-05-17 10:15
Modified
2024-11-21 08:55
Severity ?
Summary
Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.
References
Impacted products
Vendor | Product | Version |
---|
{ "cveTags": [], "descriptions": [ { "lang": "en", "value": "Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection." }, { "lang": "es", "value": "El servidor Zabbix puede realizar la ejecuci\u00f3n de comandos para scripts configurados. Despu\u00e9s de ejecutar el comando, la entrada de auditor\u00eda se agrega al \"Registro de auditor\u00eda\". Debido a que el campo \"clientip\" no est\u00e1 sanitizado, es posible inyectar SQL en \"clientip\" y explotar la inyecci\u00f3n SQL ciega basada en el tiempo." } ], "id": "CVE-2024-22120", "lastModified": "2024-11-21T08:55:37.330", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security@zabbix.com", "type": "Secondary" } ] }, "published": "2024-05-17T10:15:07.363", "references": [ { "source": "security@zabbix.com", "url": "https://support.zabbix.com/browse/ZBX-24505" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.zabbix.com/browse/ZBX-24505" } ], "sourceIdentifier": "security@zabbix.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-20" } ], "source": "security@zabbix.com", "type": "Secondary" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…