Skip to content
OpenAdvisories
High WID-SEC-2024-1811 8 CVEs

Zabbix: Mehrere Schwachstellen

Published Aug 11, 2024 · Updated Dec 1, 2024 · Revision 5 · de-DE

Vendor: Debian Vendor: Fedora Vendor: SUSE Vendor: Zabbix Product: Linux Product: Linux Product: openSUSE Product: Zabbix Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Zabbix ausnutzen, um Informationen offenzulegen, Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen oder beliebigen Code auszuführen.

Product

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Vulnerabilities 8

  • Critical 9.9
    CVE-2024-22116

    Remote code execution within ping script

    An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereb…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Critical 9.1
    CVE-2024-36461

    Direct access to memory pointers within the JS engine for modification

    Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • High 8.1
    CVE-2024-36460

    Front-end audit log shows passwords in plaintext

    The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • High 7.5
    CVE-2024-36462

    Allocation of resources without limits or throttling (uncontrolled resource consumption)

    Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or deg…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 6.1
    CVE-2024-22121

    Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe

    A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.

    Zabbix Zabbix zabbix Ubuntu
  • Medium 4.3
    CVE-2024-22114

    System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission

    User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Low 3.0
    CVE-2024-22122

    AT(GSM) Command Injection

    Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute a…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Low 2.7
    CVE-2024-22123

    Zabbix Arbitrary File Read

    Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log fil…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu

Revision history

  1. #5

    Neue Updates von openSUSE aufgenommen

  2. #4

    Neue Updates von Debian aufgenommen

  3. #3

    Neue Updates von openSUSE aufgenommen

  4. #2

    Neue Updates von Fedora aufgenommen

  5. #1

    Initiale Fassung

References