UpHeron
All vulnerabilities

Servers and applications

CVE-2024-22120

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

Severity
High 8.8
Published
17 May 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.0.28, 6.4.13
Sources
NVD

Affected software

SoftwareAffected versions
ZabbixServers and applications · cpe:a:zabbix:zabbix
  • Version 7.0.0-beta1
  • Version 7.0.0-alpha9
  • Version 7.0.0-alpha8
  • Version 7.0.0-alpha7
All 12 release lines
  • From 6.0.0 before 6.0.28
  • From 6.4.0 before 6.4.13
  • Version 7.0.0-alpha1
  • Version 7.0.0-alpha2
  • Version 7.0.0-alpha3
  • Version 7.0.0-alpha4
  • Version 7.0.0-alpha5
  • Version 7.0.0-alpha6
  • Version 7.0.0-alpha7
  • Version 7.0.0-alpha8
  • Version 7.0.0-alpha9
  • Version 7.0.0-beta1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-22120
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-22120