ALT-PU-2024-18027-1

Package update zabbix in branch p10

Version6.0.28-alt0.p10.1

Published2024-04-17

Max severityCRITICAL

Severity:

Closed issues (2)

CRITICAL9.1

Уязвимость сервера универсальной системы мониторинга Zabbix Workstation, связанная с ошибками при обработке входных данных, позволяющая нарушителю выполнить произвольный код

Published: 2024-05-20Modified: 2025-10-24

CVSS 3.xCRITICAL 9.1

CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS 2.0CRITICAL 9.0

CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C

References

CVE-2024-22120

HIGH8.8

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

Published: 2024-05-17Modified: 2025-10-08

CVSS 3.xHIGH 8.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References