{"id":"CVE-2024-22116","details":"An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.","modified":"2026-07-08T08:05:28.930517236Z","published":"2024-08-12T13:38:15.863Z","database_specific":{"unresolved_ranges":[{"source":"CPE_RANGE","vendor_product":"zabbix:zabbix","cpes":["cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.4.9"},{"last_affected":"6.4.15"}]}]},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html"},{"type":"ADVISORY","url":"https://support.zabbix.com/browse/ZBX-25016"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zabbix/zabbix","events":[{"introduced":"aef542ad8aef472874199012f9b2350db16dc7ee"},{"last_affected":"b6bea25de214bef475bcb907f27f68d4457d55b1"}],"database_specific":{"cpe":["cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:7.0.0:rc2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0.0-alpha1"},{"last_affected":"7.0.0-alpha1"},{"introduced":"7.0.0-alpha2"},{"last_affected":"7.0.0-alpha2"},{"introduced":"7.0.0-alpha3"},{"last_affected":"7.0.0-alpha3"},{"introduced":"7.0.0-alpha4"},{"last_affected":"7.0.0-alpha4"},{"introduced":"7.0.0-alpha5"},{"last_affected":"7.0.0-alpha5"},{"introduced":"7.0.0-alpha6"},{"last_affected":"7.0.0-alpha6"},{"introduced":"7.0.0-alpha7"},{"last_affected":"7.0.0-alpha7"},{"introduced":"7.0.0-alpha8"},{"last_affected":"7.0.0-alpha8"},{"introduced":"7.0.0-alpha9"},{"last_affected":"7.0.0-alpha9"},{"introduced":"7.0.0-beta1"},{"last_affected":"7.0.0-beta1"},{"introduced":"7.0.0-beta2"},{"last_affected":"7.0.0-beta2"},{"introduced":"7.0.0-beta3"},{"last_affected":"7.0.0-beta3"},{"introduced":"7.0.0-rc1"},{"last_affected":"7.0.0-rc1"},{"introduced":"7.0.0-rc2"},{"last_affected":"7.0.0-rc2"}],"source":"CPE_STRING"}}],"versions":["7.0.0-alpha1","7.0.0-alpha2","7.0.0-alpha3","7.0.0-alpha4","7.0.0-alpha5","7.0.0-alpha6","7.0.0-alpha7","7.0.0-alpha8","7.0.0-alpha9","7.0.0-beta1","7.0.0-beta2","7.0.0-beta3","7.0.0-rc1","7.0.0-rc2","7.0.0rc2","7.0.0rc1","7.0.0beta3","7.0.0beta2","7.0.0beta1","7.0.0alpha9","7.0.0alpha8","7.0.0alpha7","7.0.0alpha6","7.0.0alpha4","7.0.0alpha3","7.0.0alpha2","7.0.0alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22116.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}