Vulnerability Description
Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zabbix | Zabbix | >= 5.0.0, <= 5.0.42 |
Related Weaknesses (CWE)
References
- https://support.zabbix.com/browse/ZBX-25013Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html
FAQ
What is CVE-2024-22123?
CVE-2024-22123 is a vulnerability with a CVSS score of 2.7 (LOW). Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server wil...
How severe is CVE-2024-22123?
CVE-2024-22123 has been rated LOW with a CVSS base score of 2.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-22123?
Check the references section above for vendor advisories and patch information. Affected products include: Zabbix Zabbix.