CVE-2024-22120

Name	CVE-2024-22120
Description	Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1072120

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
zabbix (PTS)	bullseye	1:5.0.8+dfsg-1	vulnerable
	bookworm	1:6.0.14+dfsg-1	vulnerable
	sid, trixie	1:7.0.3+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
zabbix	source	buster	(not affected)
zabbix	source	(unstable)	1:6.0.29+dfsg-1			1072120

[buster] - zabbix <not-affected> (Vulnerable code introduced later)
https://support.zabbix.com/browse/ZBX-24505