VYPR
← All advisories
Critical severity9.1NVD Advisory· Published May 17, 2024· Updated Jun 17, 2026

CVE-2024-22120

CVE-2024-22120

Description

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

13
  • Zabbix/Zabbixv513 versions
    6.0.0+ 12 more
    • (no CPE)range: 6.0.0
    • cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*range: >=6.0.0,<6.0.28
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*
    • (no CPE)

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.