{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22120", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "state": "PUBLISHED", "assignerShortName": "Zabbix", "dateReserved": "2024-01-05T07:44:01.395Z", "datePublished": "2024-05-17T09:53:52.798Z", "dateUpdated": "2024-08-01T22:35:34.820Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Server"], "product": "Zabbix", "repo": "https://git.zabbix.com/", "vendor": "Zabbix", "versions": [{"changes": [{"at": "6.0.28rc1", "status": "unaffected"}], "lessThanOrEqual": "6.0.27", "status": "affected", "version": "6.0.0", "versionType": "git"}, {"changes": [{"at": "6.4.13rc1", "status": "unaffected"}], "lessThanOrEqual": "6.4.12", "status": "affected", "version": "6.4.0", "versionType": "git"}, {"changes": [{"at": "7.0.0beta1", "status": "unaffected"}], "lessThanOrEqual": "7.0.0beta1", "status": "affected", "version": "7.0.0alpha1", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank Maxim Tyukov (mf0cuz) who submitted this report in HackerOne bug bounty platform"}], "datePublic": "2024-05-17T08:22:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection."}], "value": "Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection."}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2024-05-20T06:45:42.494Z"}, "references": [{"url": "https://support.zabbix.com/browse/ZBX-24505"}], "source": {"discovery": "EXTERNAL"}, "title": "Time Based SQL Injection in Zabbix Server Audit Log", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22120", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-20T13:29:40.805103Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:zabbix:zabbix_server:*:*:*:*:*:*:*:*"], "vendor": "zabbix", "product": "zabbix_server", "versions": [{"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "6.4.0"}, {"status": "affected", "version": "7.0.0alpha1"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:52:44.718Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.820Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.zabbix.com/browse/ZBX-24505", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.zabbix.com/browse/ZBX-24505", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.820Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22120", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-20T13:29:40.805103Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:zabbix:zabbix_server:*:*:*:*:*:*:*:*"], "vendor": "zabbix", "product": "zabbix_server", "versions": [{"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "6.4.0"}, {"status": "affected", "version": "7.0.0alpha1"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-20T13:30:37.964Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Time Based SQL Injection in Zabbix Server Audit Log", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank Maxim Tyukov (mf0cuz) who submitted this report in HackerOne bug bounty platform"}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.zabbix.com/", "vendor": "Zabbix", "modules": ["Server"], "product": "Zabbix", "versions": [{"status": "affected", "changes": [{"at": "6.0.28rc1", "status": "unaffected"}], "version": "6.0.0", "versionType": "git", "lessThanOrEqual": "6.0.27"}, {"status": "affected", "changes": [{"at": "6.4.13rc1", "status": "unaffected"}], "version": "6.4.0", "versionType": "git", "lessThanOrEqual": "6.4.12"}, {"status": "affected", "changes": [{"at": "7.0.0beta1", "status": "unaffected"}], "version": "7.0.0alpha1", "versionType": "git", "lessThanOrEqual": "7.0.0beta1"}], "defaultStatus": "unaffected"}], "datePublic": "2024-05-17T08:22:00.000Z", "references": [{"url": "https://support.zabbix.com/browse/ZBX-24505"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection.", "supportingMedia": [{"type": "text/html", "value": "Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2024-05-20T06:45:42.494Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22120", "state": "PUBLISHED", "dateUpdated": "2024-08-01T22:35:34.820Z", "dateReserved": "2024-01-05T07:44:01.395Z", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "datePublished": "2024-05-17T09:53:52.798Z", "assignerShortName": "Zabbix"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "D724C8AD-C793-4602-8B1B-33B54A0A847A", "versionEndExcluding": "6.0.28", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "8507A896-08E2-4A4F-B499-66BDA79CAA32", "versionEndExcluding": "6.4.13", "versionStartIncluding": "6.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "93EB5757-7F98-4428-9616-C30A647A6612", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "DA00BDB5-433F-44E5-87AC-DA01C64B5DB3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "98C46C92-9D86-45CD-88FE-DFBB5502BB88", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "B568E6DD-A6D1-4402-BB40-7DA2596A5BC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "B9C3673B-8459-4C63-8E90-724D1D42A8BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*", "matchCriteriaId": "7C9F6957-7526-4852-A579-DE556DBFAA97", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*", "matchCriteriaId": "81A7A191-93DE-4C5D-963E-E8890FF7AACA", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*", "matchCriteriaId": "AEE202D5-3C88-43A5-9328-FC78D0B9B8CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*", "matchCriteriaId": "F88BFB75-7951-47D5-941F-3839E9E31FFA", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "8216247E-C160-4D2C-906E-9D8CD731B5C2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection."}, {"lang": "es", "value": "El servidor Zabbix puede realizar la ejecuci\u00f3n de comandos para scripts configurados. Despu\u00e9s de ejecutar el comando, la entrada de auditor\u00eda se agrega al \"Registro de auditor\u00eda\". Debido a que el campo \"clientip\" no est\u00e1 sanitizado, es posible inyectar SQL en \"clientip\" y explotar la inyecci\u00f3n SQL ciega basada en el tiempo."}], "id": "CVE-2024-22120", "lastModified": "2025-10-08T15:57:03.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security@zabbix.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-05-17T10:15:07.363", "references": [{"source": "security@zabbix.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://support.zabbix.com/browse/ZBX-24505"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://support.zabbix.com/browse/ZBX-24505"}], "sourceIdentifier": "security@zabbix.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@zabbix.com", "type": "Secondary"}]}

{}