CVE-2024-22120

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-22120

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22120.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-22120

Downstream

Published

2024-05-17T10:15:07Z

Modified

2026-10-20T15:46:19Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "6.4.0"
                        },
                        {
                            "fixed":  "6.4.13"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "zabbix:zabbix"
        }
    ]
}

References

https://support.zabbix.com/browse/ZBX-24505

Affected packages

Git / github.com/zabbix/zabbix

Affected ranges

Type

GIT

Repo

https://github.com/zabbix/zabbix

Events

Introduced

5203d2ea7d901cd33d148f20586e2155901a7faa

Fixed

a2688d6f3287ae98b833b2ff0081b90de13998a4

Introduced

aef542ad8aef472874199012f9b2350db16dc7ee

Last Affected

9bc845eca94c33485e68b46e5884a9ff6beb31cc

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.0.0"
                },
                {
                    "fixed":  "6.0.28"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0-alpha1"
                },
                {
                    "last_affected":  "7.0.0-alpha1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0-alpha2"
                },
                {
                    "last_affected":  "7.0.0-alpha2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0-alpha3"
                },
                {
                    "last_affected":  "7.0.0-alpha3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0-alpha4"
                },
                {
                    "last_affected":  "7.0.0-alpha4"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0-alpha5"
                },
                {
                    "last_affected":  "7.0.0-alpha5"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0-alpha6"
                },
                {
                    "last_affected":  "7.0.0-alpha6"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0-alpha7"
                },
                {
                    "last_affected":  "7.0.0-alpha7"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0-alpha8"
                },
                {
                    "last_affected":  "7.0.0-alpha8"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0-alpha9"
                },
                {
                    "last_affected":  "7.0.0-alpha9"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0-beta1"
                },
                {
                    "last_affected":  "7.0.0-beta1"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

6.*

6.0.0

6.0.1

6.0.10

6.0.10rc1

6.0.10rc2

6.0.11

6.0.11rc1

6.0.11rc2

6.0.12

6.0.12rc1

6.0.12rc2

6.0.13

6.0.13rc1

6.0.14

6.0.14rc1

6.0.14rc2

6.0.15

6.0.15rc1

6.0.15rc2

6.0.16

6.0.16rc1

6.0.17

6.0.17rc1

6.0.17rc2

6.0.18

6.0.18rc1

6.0.19

6.0.19rc1

6.0.1rc1

6.0.1rc2

6.0.1rc3

6.0.1rc4

6.0.2

6.0.20

6.0.20rc1

6.0.21

6.0.21rc1

6.0.22

6.0.22rc1

6.0.23

6.0.23rc1

6.0.25

6.0.25rc1

6.0.26

6.0.26rc1

6.0.27

6.0.27rc1

6.0.28rc1

6.0.2rc1

6.0.3

6.0.3rc1

6.0.4

6.0.4rc1

6.0.5

6.0.5rc1

6.0.6

6.0.6rc1

6.0.7

6.0.7rc1

6.0.8

6.0.8rc1

6.0.8rc2

6.0.9

6.0.9rc1

6.0.9rc2

7.*

7.0.0-alpha1

7.0.0-alpha2

7.0.0-alpha3

7.0.0-alpha4

7.0.0-alpha5

7.0.0-alpha6

7.0.0-alpha7

7.0.0-alpha8

7.0.0-alpha9

7.0.0-beta1

7.0.0alpha1

7.0.0alpha2

7.0.0alpha3

7.0.0alpha4

7.0.0alpha6

7.0.0alpha7

7.0.0alpha8

7.0.0alpha9

7.0.0beta1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22120.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "110202707769646289360863804917839952625",
                "70011501982579003761526415264820233694",
                "317844913970292851207837636818495821458",
                "111921237337563155455877019768149306981",
                "80306552244886662200115333223747986013",
                "174249830971715778239745799358348822334"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2024-22120-5936a5c2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zabbix/zabbix/commit/a2688d6f3287ae98b833b2ff0081b90de13998a4",
        "target":  {
            "file":  "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
        }
    }
]

vanir_signatures_modified

"2026-10-20T15:46:19Z"