CVE-2024-22116: 
Zabbix Server vulnerability analysis and mitigation

CVE-2024-22116 is a critical security vulnerability discovered in Zabbix Server affecting versions 6.4.9 through 6.4.15 and 7.0.0alpha1 through 7.0.0rc2. The vulnerability was disclosed on August 9, 2024, and allows administrators with restricted permissions to exploit script execution functionality within the Monitoring Hosts section (Vendor Advisory).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and received a CVSS v3.1 base score of 9.9 (Critical) from Zabbix with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The NIST assessment assigned a slightly lower score of 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The core issue stems from a lack of default escaping for script parameters in the Ping script functionality (NVD, Vendor Advisory).

The vulnerability enables administrators with restricted permissions to execute arbitrary code via the Ping script, potentially leading to complete infrastructure compromise. This allows for high-level impacts on confidentiality, integrity, and availability of the affected systems (Vendor Advisory).

Zabbix has released patches to address this vulnerability in versions 6.4.16rc1 and 7.0.0rc3. Users of affected versions are strongly advised to upgrade to these patched versions (ASEC).