fkie_cve-2024-22123
Vulnerability from fkie_nvd
Published
2024-08-12 13:38
Modified
2024-12-10 16:32
Severity ?
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Summary
Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.
References
security@zabbix.comhttps://support.zabbix.com/browse/ZBX-25013Vendor Advisory
Impacted products
Vendor Product Version
zabbix zabbix *
zabbix zabbix *
zabbix zabbix *
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0
zabbix zabbix 7.0.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5950D0D-9DFF-4B36-9AAF-43CBCEFE7101",
              "versionEndIncluding": "5.0.42",
              "versionStartIncluding": "5.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1D26F5C-A94F-4273-81D7-7DDF7541C3E7",
              "versionEndIncluding": "6.0.30",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0DA6900-EB3E-4867-BD97-243686EECADD",
              "versionEndIncluding": "6.4.15",
              "versionStartIncluding": "6.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "93EB5757-7F98-4428-9616-C30A647A6612",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*",
              "matchCriteriaId": "DA00BDB5-433F-44E5-87AC-DA01C64B5DB3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*",
              "matchCriteriaId": "98C46C92-9D86-45CD-88FE-DFBB5502BB88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*",
              "matchCriteriaId": "B568E6DD-A6D1-4402-BB40-7DA2596A5BC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*",
              "matchCriteriaId": "B9C3673B-8459-4C63-8E90-724D1D42A8BB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*",
              "matchCriteriaId": "7C9F6957-7526-4852-A579-DE556DBFAA97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*",
              "matchCriteriaId": "81A7A191-93DE-4C5D-963E-E8890FF7AACA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*",
              "matchCriteriaId": "AEE202D5-3C88-43A5-9328-FC78D0B9B8CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*",
              "matchCriteriaId": "F88BFB75-7951-47D5-941F-3839E9E31FFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "8216247E-C160-4D2C-906E-9D8CD731B5C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "06548219-0DC3-4B5B-85D1-B1EE0FA30CD2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "4D23985B-2F4D-41F6-B9D6-7B184FC7E447",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "97964B9B-6A5E-4547-8886-E81B0849A876",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "40992B5F-0D83-4D5C-9188-E84C369FF92F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI."
    },
    {
      "lang": "es",
      "value": "La configuraci\u00f3n de medios SMS permite configurar el archivo del m\u00f3dem GSM. Posteriormente este archivo se utiliza como dispositivo Linux. Pero debido a que todo es un archivo para Linux, es posible configurar otro archivo, por ejemplo, un archivo de registro y zabbix_server intentar\u00e1 comunicarse con \u00e9l como m\u00f3dem. Como resultado, el archivo de registro se romper\u00e1 con los comandos AT y una peque\u00f1a parte del contenido del archivo de registro se filtrar\u00e1 a la interfaz de usuario."
    }
  ],
  "id": "CVE-2024-22123",
  "lastModified": "2024-12-10T16:32:45.670",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 1.4,
        "source": "security@zabbix.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-08-12T13:38:16.520",
  "references": [
    {
      "source": "security@zabbix.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.zabbix.com/browse/ZBX-25013"
    }
  ],
  "sourceIdentifier": "security@zabbix.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security@zabbix.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.