CVE-2024-22116

NameCVE-2024-22116
DescriptionAn administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3909-1
Debian Bugs1078553

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
zabbix (PTS)bullseye1:5.0.8+dfsg-1vulnerable
bullseye (security)1:5.0.45+dfsg-1+deb11u1fixed
bookworm1:6.0.14+dfsg-1vulnerable
sid, trixie1:7.0.6+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
zabbixsourcebullseye1:5.0.44+dfsg-1+deb11u1DLA-3909-1
zabbixsource(unstable)1:7.0.0+dfsg-11078553

Notes

https://support.zabbix.com/browse/ZBX-25016
https://github.com/zabbix/zabbix/commit/afb3ab931d59af61e4f974634b85bcbed5a042b2 (7.0.x)
https://github.com/zabbix/zabbix/commit/679e18f172fc1f9a78b19789fbbc52246871ff19 (7.0.x)
https://github.com/zabbix/zabbix/commit/e6acaef1df1db44aaa9c1a0e1953a4da21425636 (7.0.x)
https://github.com/zabbix/zabbix/commit/182e1a9d96dcd82de337b31dc1cbbd6b4b619281 (6.4.x)
https://github.com/zabbix/zabbix/commit/a2dad304083387b8597ef1d67394f285b105f614 (6.4.x)

Search for package or bug name: Reporting problems