{
  "cveId": "CVE-2024-22120",
  "url": "https://patchblox.com/security/cve/CVE-2024-22120",
  "summary": "CVE-2024-22120 is fixed in zabbix on 1 platform, first by DEBIAN-CVE-2024-22120, released May 17, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "zabbix: Zabbix server can perform command execution for configured scripts",
  "description": "Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \u0022Audit Log\u0022. Due to \u0022clientip\u0022 field is not sanitized, it is possible to injection SQL into \u0022clientip\u0022 and exploit time based blind SQL injection.",
  "published": "2024-05-17T10:15:07Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.76618,
  "epssPercentile": 0.99547,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "zabbix",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:6.0.29\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-22120",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-22120",
      "released": "2024-05-17T10:15:07Z"
    },
    {
      "platform": "linux",
      "product": "zabbix",
      "release": "Debian 14",
      "fixedVersion": "1:6.0.29\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-22120",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-22120",
      "released": "2024-05-17T10:15:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}