Report feedback

Allows an authenticated remote attacker to abuse the script execution feature in the Monitoring Hosts section, where the absence of default escaping of script parameters allows arbitrary code to be executed [1].

The vulnerability is present in product:

• Zabbix; >=6.4.0, <=6.4.15; >=7.0.0alpha1, <=7.0.0rc2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2024-22116 at cve.org, NVD
• CWE-94: Improper Control of Generation of Code at cwe.mitre.org

The vulnerability was publicly disclosed 9. 8. 2024.

Allows an authenticated remote attacker with access to the configuration of a single item (restricted role) to execute code remotely [2].

The vulnerability is present in product:

• Zabbix; >=6.0.0, <=6.0.30; >=6.4.0, <=6.4.1; >=7.0.0alpha1, <=7.0.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

More information:

• CVE-2024-36461 at cve.org, NVD
• CWE-822: Untrusted Pointer Dereference at cwe.mitre.org

The vulnerability was publicly disclosed 9. 8. 2024.

Allows an authenticated remote attacker to view unprotected plain-text passwords through the front-end audit log [3].

The vulnerability is present in product:

• Zabbix; >=5.0.0, <=5.0.42; >=6.0.0,<=6.0.30; >=6.4.0, <=6.4.15; >=7.0.0alpha1, <=7.0.0rc2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

More information:

• CVE-2024-36460 at cve.org, NVD
• CWE-256: Plaintext Storage of a Password at cwe.mitre.org

The vulnerability was publicly disclosed 9. 8. 2024.

Allows an unauthenticated remote attacker to cause a denial of service, degrade the performance of the affected system or crash the server due to excessive resource consumption [4].

The vulnerability is present in product:

• Zabbix; >=7.0.0alpha1, <=7.0.0rc2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2024-36462 at cve.org, NVD
• CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org

The vulnerability was publicly disclosed 9. 8. 2024.

Allows an authenticated local attacker who is not an administrator to modify or remove important functions (e.g. removing the Zabbix Agent Service) within the application, thereby affecting its integrity and availability [5].

The vulnerability is present in product:

• Zabbix; >=5.0.0, <=5.0.42; >=6.0.0,<=6.0.30; >=6.4.0, <=6.4.15; >=7.0.0alpha1, <=7.0.0rc2

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

More information:

• CVE-2024-22121 at cve.org, NVD
• CWE-281: Improper Preservation of Permissions at cwe.mitre.org

The vulnerability was publicly disclosed 9. 8. 2024.

Allows an authenticated remote attacker to obtain statistics, such as the total number of hosts and other data, through the System Information Widget [6].

The vulnerability is present in product:

• Zabbix; >=5.0.0, <=5.0.42; >=6.0.0,<=6.0.30; >=6.4.0, <=6.4.15; >=7.0.0alpha1, <=7.0.0rc2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

• CVE-2024-22114 at cve.org, NVD
• CWE-281: Improper Preservation of Permissions at cwe.mitre.org

The vulnerability was publicly disclosed 9. 8. 2024.

Allows an authenticated remote attacker to corrupt the Zabbix log file and read a small part of the logs [7]. If the server were run by a more privileged user, the attacker would be able to carry out a DoS attack [7].

The vulnerability is present in product:

• Zabbix; >=5.0.0, <=5.0.42; >=6.0.0,<=6.0.30; >=6.4.0, <=6.4.15; >=7.0.0alpha1, <=7.0.0rc2

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

More information:

• CVE-2024-22123 at cve.org, NVD
• CWE-94: Improper Control of Generation of Code at cwe.mitre.org

The vulnerability was publicly disclosed 9. 8. 2024.