High WID-SEC-2024-1192 1 CVE

Zabbix: Schwachstelle ermöglicht Codeausführung

Published May 20, 2024 · Updated May 20, 2024 · de-DE

Vendor: Zabbix Product: Zabbix Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Zabbix ausnutzen, um beliebigen Programmcode auszuführen.

Product

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Vulnerabilities 1

Critical 9.1

CVE-2024-22120 Public exploit EPSS 77%

Time Based SQL Injection in Zabbix Server Audit Log

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL inje…

Zabbix Zabbix zabbix zabbix Debian Ubuntu Alpine

May 17, 2024

Revision history

2024-05-20 #1
Initiale Fassung

References

ZABBIX BUGS AND ISSUES ZBX-24505 vom 2024-05-20
https://support.zabbix.com/browse/ZBX-24505