CVE-2024-22119 - Vulnerability Details

Vendors	Products
Zabbix	Zabbix

Link	Providers
https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html
https://support.zabbix.com/browse/ZBX-24070

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22119", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "state": "PUBLISHED", "assignerShortName": "Zabbix", "dateReserved": "2024-01-05T07:44:01.395Z", "datePublished": "2024-02-09T08:26:20.006Z", "dateUpdated": "2025-02-13T17:33:29.778Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Frontend"], "product": "Zabbix", "repo": "https://git.zabbix.com/", "vendor": "Zabbix", "versions": [{"changes": [{"at": "5.0.40rc1", "status": "unaffected"}], "lessThanOrEqual": "5.0.39", "status": "affected", "version": "5.0.0", "versionType": "git"}, {"changes": [{"at": "6.0.24rc1", "status": "unaffected"}], "lessThanOrEqual": "6.0.23", "status": "affected", "version": "6.0.0", "versionType": "git"}, {"changes": [{"at": "6.4.9rc1", "status": "unaffected"}], "lessThanOrEqual": "6.4.8", "status": "affected", "version": "6.4.0", "versionType": "git"}, {"changes": [{"at": "7.0.0alpha8", "status": "unaffected"}], "lessThanOrEqual": "7.0.0alpha7", "status": "affected", "version": "7.0.0alpha1", "versionType": "git"}]}], "datePublic": "2024-01-05T08:23:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The cause of vulnerability is improper validation of form input field \u201cName\u201d on Graph page in Items section."}], "value": "The cause of vulnerability is improper validation of form input field \u201cName\u201d on Graph page in Items section."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2024-04-28T20:05:54.831Z"}, "references": [{"url": "https://support.zabbix.com/browse/ZBX-24070"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html"}], "source": {"discovery": "INTERNAL"}, "title": "Stored XSS in graph items select form", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.822Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.zabbix.com/browse/ZBX-24070", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-22119 (string)

assignerOrgId : 72de3e22-0555-4a0d-ae81-9249e0f0a1e8 (string)

state : PUBLISHED (string)

assignerShortName : Zabbix (string)

dateReserved : 2024-01-05T07:44:01.395Z (string)

datePublished : 2024-02-09T08:26:20.006Z (string)

dateUpdated : 2025-02-13T17:33:29.778Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Frontend (string)

]

product : Zabbix (string)

repo : https://git.zabbix.com/ (string)

vendor : Zabbix (string)

versions : [ »

0 : { »

changes : [ »

0 : { »

at : 5.0.40rc1 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 5.0.39 (string)

status : affected (string)

version : 5.0.0 (string)

versionType : git (string)

}

1 : { »

changes : [ »

0 : { »

at : 6.0.24rc1 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 6.0.23 (string)

status : affected (string)

version : 6.0.0 (string)

versionType : git (string)

}

2 : { »

changes : [ »

0 : { »

at : 6.4.9rc1 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 6.4.8 (string)

status : affected (string)

version : 6.4.0 (string)

versionType : git (string)

}

3 : { »

changes : [ »

0 : { »

at : 7.0.0alpha8 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 7.0.0alpha7 (string)

status : affected (string)

version : 7.0.0alpha1 (string)

versionType : git (string)

}

]

}

]

datePublic : 2024-01-05T08:23:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. (string)

}

]

value : The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-592 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-592 Stored XSS (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-20 (string)

description : CWE-20 Improper Input Validation (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 72de3e22-0555-4a0d-ae81-9249e0f0a1e8 (string)

shortName : Zabbix (string)

dateUpdated : 2024-04-28T20:05:54.831Z (string)

}

references : [ »

0 : { »

url : https://support.zabbix.com/browse/ZBX-24070 (string)

}

1 : { »

url : https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html (string)

}

]

source : { »

discovery : INTERNAL (string)

}

title : Stored XSS in graph items select form (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T22:35:34.822Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://support.zabbix.com/browse/ZBX-24070 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C94731C-B779-45AD-BBB4-E6F0D5A3E149", "versionEndExcluding": "5.0.40", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "398840EF-B622-4395-8336-92ADABBBA142", "versionEndExcluding": "6.0.24", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6105048-6C2E-4638-9595-3BEB09D06442", "versionEndExcluding": "6.4.9", "versionStartIncluding": "6.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "93EB5757-7F98-4428-9616-C30A647A6612", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "DA00BDB5-433F-44E5-87AC-DA01C64B5DB3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "98C46C92-9D86-45CD-88FE-DFBB5502BB88", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "B568E6DD-A6D1-4402-BB40-7DA2596A5BC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "B9C3673B-8459-4C63-8E90-724D1D42A8BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*", "matchCriteriaId": "7C9F6957-7526-4852-A579-DE556DBFAA97", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*", "matchCriteriaId": "81A7A191-93DE-4C5D-963E-E8890FF7AACA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The cause of vulnerability is improper validation of form input field \u201cName\u201d on Graph page in Items section."}, {"lang": "es", "value": "La causa de la vulnerabilidad es la validaci\u00f3n inadecuada del campo de entrada del formulario \"Nombre\" en la p\u00e1gina Gr\u00e1fico en la secci\u00f3n Elementos."}], "id": "CVE-2024-22119", "lastModified": "2024-11-21T08:55:37.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.4, "source": "security@zabbix.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-09T09:15:08.380", "references": [{"source": "security@zabbix.com", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html"}, {"source": "security@zabbix.com", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://support.zabbix.com/browse/ZBX-24070"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://support.zabbix.com/browse/ZBX-24070"}], "sourceIdentifier": "security@zabbix.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@zabbix.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 2C94731C-B779-45AD-BBB4-E6F0D5A3E149 (string)

versionEndExcluding : 5.0.40 (string)

versionStartIncluding : 5.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 398840EF-B622-4395-8336-92ADABBBA142 (string)

versionEndExcluding : 6.0.24 (string)

versionStartIncluding : 6.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B6105048-6C2E-4638-9595-3BEB09D06442 (string)

versionEndExcluding : 6.4.9 (string)

versionStartIncluding : 6.4.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:* (string)

matchCriteriaId : 93EB5757-7F98-4428-9616-C30A647A6612 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:* (string)

matchCriteriaId : DA00BDB5-433F-44E5-87AC-DA01C64B5DB3 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:* (string)

matchCriteriaId : 98C46C92-9D86-45CD-88FE-DFBB5502BB88 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:* (string)

matchCriteriaId : B568E6DD-A6D1-4402-BB40-7DA2596A5BC8 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:* (string)

matchCriteriaId : B9C3673B-8459-4C63-8E90-724D1D42A8BB (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:* (string)

matchCriteriaId : 7C9F6957-7526-4852-A579-DE556DBFAA97 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:* (string)

matchCriteriaId : 81A7A191-93DE-4C5D-963E-E8890FF7AACA (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. (string)

}

1 : { »

lang : es (string)

value : La causa de la vulnerabilidad es la validación inadecuada del campo de entrada del formulario "Nombre" en la página Gráfico en la sección Elementos. (string)

}

]

id : CVE-2024-22119 (string)

lastModified : 2024-11-21T08:55:37.150 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 2.1 (number)

impactScore : 3.4 (number)

source : security@zabbix.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.3 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-02-09T09:15:08.380 (string)

references : [ »

0 : { »

source : security@zabbix.com (string)

url : https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html (string)

}

1 : { »

source : security@zabbix.com (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Patch (string)

3 : Vendor Advisory (string)

]

url : https://support.zabbix.com/browse/ZBX-24070 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Patch (string)

3 : Vendor Advisory (string)

]

url : https://support.zabbix.com/browse/ZBX-24070 (string)

}

]

sourceIdentifier : security@zabbix.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-20 (string)

}

]

source : security@zabbix.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object