CVE-2024-22121 - Vulnerability Details

Vendors	Products
Zabbix	Zabbix

Link	Providers
https://support.zabbix.com/browse/ZBX-25011

Type	Values Removed	Values Added
First Time appeared		Zabbix Zabbix zabbix
CPEs		cpe:2.3:a:zabbix:zabbix:::::::: cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:rc1:::::: cpe:2.3:a:zabbix:zabbix:7.0.0:rc2::::::
Vendors & Products		Zabbix Zabbix zabbix

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
References	https://support.zabbix.com/browse/ZBX-25000	https://support.zabbix.com/browse/ZBX-25011

Type	Values Removed	Values Added
Description		A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.
Title		Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe
Weaknesses		CWE-281
References		https://support.zabbix.com/browse/ZBX-25000
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22121", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "state": "PUBLISHED", "assignerShortName": "Zabbix", "dateReserved": "2024-01-05T07:44:01.395Z", "datePublished": "2024-08-09T08:34:47.392Z", "dateUpdated": "2024-08-09T15:17:48.357Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Agent"], "product": "Zabbix", "repo": "https://git.zabbix.com/", "vendor": "Zabbix", "versions": [{"changes": [{"at": "5.0.43rc1", "status": "unaffected"}], "lessThanOrEqual": "5.0.42", "status": "affected", "version": "5.0.0", "versionType": "git"}, {"changes": [{"at": "6.0.31rc1", "status": "unaffected"}], "lessThanOrEqual": "6.0.30", "status": "affected", "version": "6.0.0", "versionType": "git"}, {"changes": [{"at": "6.4.16rc1", "status": "unaffected"}], "lessThanOrEqual": "6.4.15", "status": "affected", "version": "6.4.0", "versionType": "git"}, {"changes": [{"at": "7.0.0rc3", "status": "unaffected"}], "lessThanOrEqual": "7.0.0rc2", "status": "affected", "version": "7.0.0alpha1", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank gee-netics who submitted this report in HackerOne bug bounty platform"}], "datePublic": "2024-06-12T10:37:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application."}], "value": "A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-281", "description": "CWE-281 Improper Preservation of Permissions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2024-08-09T13:08:21.185Z"}, "references": [{"url": "https://support.zabbix.com/browse/ZBX-25011"}], "source": {"discovery": "EXTERNAL"}, "title": "Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-09T15:17:38.497917Z", "id": "CVE-2024-22121", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-09T15:17:48.357Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-22121 (string)

assignerOrgId : 72de3e22-0555-4a0d-ae81-9249e0f0a1e8 (string)

state : PUBLISHED (string)

assignerShortName : Zabbix (string)

dateReserved : 2024-01-05T07:44:01.395Z (string)

datePublished : 2024-08-09T08:34:47.392Z (string)

dateUpdated : 2024-08-09T15:17:48.357Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Agent (string)

]

product : Zabbix (string)

repo : https://git.zabbix.com/ (string)

vendor : Zabbix (string)

versions : [ »

0 : { »

changes : [ »

0 : { »

at : 5.0.43rc1 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 5.0.42 (string)

status : affected (string)

version : 5.0.0 (string)

versionType : git (string)

}

1 : { »

changes : [ »

0 : { »

at : 6.0.31rc1 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 6.0.30 (string)

status : affected (string)

version : 6.0.0 (string)

versionType : git (string)

}

2 : { »

changes : [ »

0 : { »

at : 6.4.16rc1 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 6.4.15 (string)

status : affected (string)

version : 6.4.0 (string)

versionType : git (string)

}

3 : { »

changes : [ »

0 : { »

at : 7.0.0rc3 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 7.0.0rc2 (string)

status : affected (string)

version : 7.0.0alpha1 (string)

versionType : git (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : reporter (string)

value : Zabbix wants to thank gee-netics who submitted this report in HackerOne bug bounty platform (string)

}

]

datePublic : 2024-06-12T10:37:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. (string)

}

]

value : A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-180 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : LOW (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-281 (string)

description : CWE-281 Improper Preservation of Permissions (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 72de3e22-0555-4a0d-ae81-9249e0f0a1e8 (string)

shortName : Zabbix (string)

dateUpdated : 2024-08-09T13:08:21.185Z (string)

}

references : [ »

0 : { »

url : https://support.zabbix.com/browse/ZBX-25011 (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

title : Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-09T15:17:38.497917Z (string)

id : CVE-2024-22121 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-09T15:17:48.357Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22121", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-09T15:17:38.497917Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-09T15:17:43.829Z"}}], "cna": {"title": "Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank gee-netics who submitted this report in HackerOne bug bounty platform"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.zabbix.com/", "vendor": "Zabbix", "modules": ["Agent"], "product": "Zabbix", "versions": [{"status": "affected", "changes": [{"at": "5.0.43rc1", "status": "unaffected"}], "version": "5.0.0", "versionType": "git", "lessThanOrEqual": "5.0.42"}, {"status": "affected", "changes": [{"at": "6.0.31rc1", "status": "unaffected"}], "version": "6.0.0", "versionType": "git", "lessThanOrEqual": "6.0.30"}, {"status": "affected", "changes": [{"at": "6.4.16rc1", "status": "unaffected"}], "version": "6.4.0", "versionType": "git", "lessThanOrEqual": "6.4.15"}, {"status": "affected", "changes": [{"at": "7.0.0rc3", "status": "unaffected"}], "version": "7.0.0alpha1", "versionType": "git", "lessThanOrEqual": "7.0.0rc2"}], "defaultStatus": "unaffected"}], "datePublic": "2024-06-12T10:37:00.000Z", "references": [{"url": "https://support.zabbix.com/browse/ZBX-25011"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.", "supportingMedia": [{"type": "text/html", "value": "A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-281", "description": "CWE-281 Improper Preservation of Permissions"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2024-08-09T13:08:21.185Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22121", "state": "PUBLISHED", "dateUpdated": "2024-08-09T15:17:48.357Z", "dateReserved": "2024-01-05T07:44:01.395Z", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "datePublished": "2024-08-09T08:34:47.392Z", "assignerShortName": "Zabbix"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-22121 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-09T15:17:38.497917Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-09T15:17:43.829Z (string)

}

]

cna : { »

title : Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe (string)

source : { »

discovery : EXTERNAL (string)

}

credits : [ »

0 : { »

lang : en (string)

type : reporter (string)

value : Zabbix wants to thank gee-netics who submitted this report in HackerOne bug bounty platform (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-180 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.1 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : LOW (string)

privilegesRequired : LOW (string)

confidentialityImpact : NONE (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

repo : https://git.zabbix.com/ (string)

vendor : Zabbix (string)

modules : [ »

0 : Agent (string)

]

product : Zabbix (string)

versions : [ »

0 : { »

status : affected (string)

changes : [ »

0 : { »

at : 5.0.43rc1 (string)

status : unaffected (string)

}

]

version : 5.0.0 (string)

versionType : git (string)

lessThanOrEqual : 5.0.42 (string)

}

1 : { »

status : affected (string)

changes : [ »

0 : { »

at : 6.0.31rc1 (string)

status : unaffected (string)

}

]

version : 6.0.0 (string)

versionType : git (string)

lessThanOrEqual : 6.0.30 (string)

}

2 : { »

status : affected (string)

changes : [ »

0 : { »

at : 6.4.16rc1 (string)

status : unaffected (string)

}

]

version : 6.4.0 (string)

versionType : git (string)

lessThanOrEqual : 6.4.15 (string)

}

3 : { »

status : affected (string)

changes : [ »

0 : { »

at : 7.0.0rc3 (string)

status : unaffected (string)

}

]

version : 7.0.0alpha1 (string)

versionType : git (string)

lessThanOrEqual : 7.0.0rc2 (string)

}

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-06-12T10:37:00.000Z (string)

references : [ »

0 : { »

url : https://support.zabbix.com/browse/ZBX-25011 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-281 (string)

description : CWE-281 Improper Preservation of Permissions (string)

}

]

}

]

providerMetadata : { »

orgId : 72de3e22-0555-4a0d-ae81-9249e0f0a1e8 (string)

shortName : Zabbix (string)

dateUpdated : 2024-08-09T13:08:21.185Z (string)

}

cveMetadata : { »

cveId : CVE-2024-22121 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-09T15:17:48.357Z (string)

dateReserved : 2024-01-05T07:44:01.395Z (string)

assignerOrgId : 72de3e22-0555-4a0d-ae81-9249e0f0a1e8 (string)

datePublished : 2024-08-09T08:34:47.392Z (string)

assignerShortName : Zabbix (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "D5950D0D-9DFF-4B36-9AAF-43CBCEFE7101", "versionEndIncluding": "5.0.42", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "D1D26F5C-A94F-4273-81D7-7DDF7541C3E7", "versionEndIncluding": "6.0.30", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "E0DA6900-EB3E-4867-BD97-243686EECADD", "versionEndIncluding": "6.4.15", "versionStartIncluding": "6.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "93EB5757-7F98-4428-9616-C30A647A6612", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "DA00BDB5-433F-44E5-87AC-DA01C64B5DB3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "98C46C92-9D86-45CD-88FE-DFBB5502BB88", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "B568E6DD-A6D1-4402-BB40-7DA2596A5BC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "B9C3673B-8459-4C63-8E90-724D1D42A8BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*", "matchCriteriaId": "7C9F6957-7526-4852-A579-DE556DBFAA97", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*", "matchCriteriaId": "81A7A191-93DE-4C5D-963E-E8890FF7AACA", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*", "matchCriteriaId": "AEE202D5-3C88-43A5-9328-FC78D0B9B8CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*", "matchCriteriaId": "F88BFB75-7951-47D5-941F-3839E9E31FFA", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "8216247E-C160-4D2C-906E-9D8CD731B5C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "06548219-0DC3-4B5B-85D1-B1EE0FA30CD2", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "4D23985B-2F4D-41F6-B9D6-7B184FC7E447", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "97964B9B-6A5E-4547-8886-E81B0849A876", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:7.0.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "40992B5F-0D83-4D5C-9188-E84C369FF92F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application."}, {"lang": "es", "value": "Un usuario que no sea administrador puede cambiar o eliminar funciones importantes dentro de la aplicaci\u00f3n Zabbix Agent, lo que afectar\u00e1 la integridad y disponibilidad de la aplicaci\u00f3n."}], "id": "CVE-2024-22121", "lastModified": "2024-12-10T16:19:19.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "security@zabbix.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-08-12T13:38:16.070", "references": [{"source": "security@zabbix.com", "tags": ["Vendor Advisory"], "url": "https://support.zabbix.com/browse/ZBX-25011"}], "sourceIdentifier": "security@zabbix.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-281"}], "source": "security@zabbix.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-281"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D5950D0D-9DFF-4B36-9AAF-43CBCEFE7101 (string)

versionEndIncluding : 5.0.42 (string)

versionStartIncluding : 5.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D1D26F5C-A94F-4273-81D7-7DDF7541C3E7 (string)

versionEndIncluding : 6.0.30 (string)

versionStartIncluding : 6.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E0DA6900-EB3E-4867-BD97-243686EECADD (string)

versionEndIncluding : 6.4.15 (string)

versionStartIncluding : 6.4.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:* (string)

matchCriteriaId : 93EB5757-7F98-4428-9616-C30A647A6612 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:* (string)

matchCriteriaId : DA00BDB5-433F-44E5-87AC-DA01C64B5DB3 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:* (string)

matchCriteriaId : 98C46C92-9D86-45CD-88FE-DFBB5502BB88 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:* (string)

matchCriteriaId : B568E6DD-A6D1-4402-BB40-7DA2596A5BC8 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:* (string)

matchCriteriaId : B9C3673B-8459-4C63-8E90-724D1D42A8BB (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:* (string)

matchCriteriaId : 7C9F6957-7526-4852-A579-DE556DBFAA97 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:* (string)

matchCriteriaId : 81A7A191-93DE-4C5D-963E-E8890FF7AACA (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:* (string)

matchCriteriaId : AEE202D5-3C88-43A5-9328-FC78D0B9B8CF (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:* (string)

matchCriteriaId : F88BFB75-7951-47D5-941F-3839E9E31FFA (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:* (string)

matchCriteriaId : 8216247E-C160-4D2C-906E-9D8CD731B5C2 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:*:*:*:*:*:* (string)

matchCriteriaId : 06548219-0DC3-4B5B-85D1-B1EE0FA30CD2 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:*:*:*:*:*:* (string)

matchCriteriaId : 4D23985B-2F4D-41F6-B9D6-7B184FC7E447 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:rc1:*:*:*:*:*:* (string)

matchCriteriaId : 97964B9B-6A5E-4547-8886-E81B0849A876 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:zabbix:zabbix:7.0.0:rc2:*:*:*:*:*:* (string)

matchCriteriaId : 40992B5F-0D83-4D5C-9188-E84C369FF92F (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. (string)

}

1 : { »

lang : es (string)

value : Un usuario que no sea administrador puede cambiar o eliminar funciones importantes dentro de la aplicación Zabbix Agent, lo que afectará la integridad y disponibilidad de la aplicación. (string)

}

]

id : CVE-2024-22121 (string)

lastModified : 2024-12-10T16:19:19.810 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : LOW (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 4.2 (number)

source : security@zabbix.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : LOW (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 4.2 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-08-12T13:38:16.070 (string)

references : [ »

0 : { »

source : security@zabbix.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.zabbix.com/browse/ZBX-25011 (string)

}

]

sourceIdentifier : security@zabbix.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-281 (string)

}

]

source : security@zabbix.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-281 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object