CVE-2024-22120

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-22120
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22120.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-22120
Downstream
Published
2024-05-17T10:15:07.363Z
Modified
2026-04-12T05:53:15.049954Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

References

Affected packages

Git / github.com/zabbix/zabbix

Affected ranges

Type
GIT
Repo
https://github.com/zabbix/zabbix
Events
Introduced
5203d2ea7d901cd33d148f20586e2155901a7faa
Fixed
a2688d6f3287ae98b833b2ff0081b90de13998a4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
aef542ad8aef472874199012f9b2350db16dc7ee
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
72e3519b849b54011cc7792669fbcc629eb502c9
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8880b5094a533ea929452b4aebf021914df01eb8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6a0cc01bda00a30dba89b5ce4b32929393e0b523
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5da045b87956adeab639bf0b3d71f8c99a664233
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
cf4c50ece539d86f04d88401045c703b5ae4cfe9
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
721b0012b82edad4dd6617b0e2aa934611cc8cec
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
78774f702f8d222235c6e5a8b27db9490386c2e9
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6c4616adff77b12e9e208c55257522f9a3cd8430
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9bc845eca94c33485e68b46e5884a9ff6beb31cc
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.28"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0-alpha1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0-alpha2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0-alpha3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0-alpha4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0-alpha5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0-alpha6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0-alpha7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0-alpha8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0-alpha9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0-beta1"
        }
    ]
}

Affected versions

6.*
6.0.0
6.0.1
6.0.10
6.0.10rc1
6.0.10rc2
6.0.11
6.0.11rc1
6.0.11rc2
6.0.12
6.0.12rc1
6.0.12rc2
6.0.13
6.0.13rc1
6.0.14
6.0.14rc1
6.0.14rc2
6.0.15
6.0.15rc1
6.0.15rc2
6.0.16
6.0.16rc1
6.0.17
6.0.17rc1
6.0.17rc2
6.0.18
6.0.18rc1
6.0.19
6.0.19rc1
6.0.1rc1
6.0.1rc2
6.0.1rc3
6.0.1rc4
6.0.2
6.0.20
6.0.20rc1
6.0.21
6.0.21rc1
6.0.22
6.0.22rc1
6.0.23
6.0.23rc1
6.0.25
6.0.25rc1
6.0.26
6.0.26rc1
6.0.27
6.0.27rc1
6.0.28rc1
6.0.2rc1
6.0.3
6.0.3rc1
6.0.4
6.0.4rc1
6.0.5
6.0.5rc1
6.0.6
6.0.6rc1
6.0.7
6.0.7rc1
6.0.8
6.0.8rc1
6.0.8rc2
6.0.9
6.0.9rc1
6.0.9rc2
7.*
7.0.0alpha1
7.0.0alpha2
7.0.0alpha3
7.0.0alpha4
7.0.0alpha5
7.0.0alpha6
7.0.0alpha7
7.0.0alpha8
7.0.0alpha9
7.0.0beta1

Database specific

vanir_signatures 
[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "110202707769646289360863804917839952625",
                "70011501982579003761526415264820233694",
                "317844913970292851207837636818495821458",
                "111921237337563155455877019768149306981",
                "80306552244886662200115333223747986013",
                "174249830971715778239745799358348822334"
            ]
        },
        "target": {
            "file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        },
        "id": "CVE-2024-22120-5936a5c2",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://github.com/zabbix/zabbix/commit/a2688d6f3287ae98b833b2ff0081b90de13998a4"
    }
]
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "6.4.0"
            },
            {
                "fixed": "6.4.13"
            }
        ]
    }
]
vanir_signatures_modified 
"2026-04-12T05:53:15Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22120.json"