CVE-2024-22120criticalobserved exploitationCWE-20

CVE-2024-22120: critical vulnerability in Zabbix

Time Based SQL Injection in Zabbix Server Audit Log

Published · Updated

Follow this CVE+ Monitor Zabbix+ Monitor zabbix

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

97Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 9.1epss 77%
from disclosure to weapon3 days
Published on NVDMay 17
1st PoC+3d
VulnCheck+306d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
Zabbix · Zabbix
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Zabbix

In the same product, most dangerous first.

CVE-2024-42327CRITICALSQL injection in user.get APIEPSS 79.1%CVE-2013-3628—CVE-2013-3628EPSS 67.5%CVE-2023-29452MEDIUMRemove possibility to add html into Geomap attribution fieldEPSS 64.1%CVE-2024-36465HIGHSQL injection in Zabbix APIEPSS 39.9%CVE-2026-23921HIGHBlind, read-only SQL injection in Zabbix API via sortfield parameterEPSS 4.2%CVE-2024-22122LOWAT(GSM) Command InjectionEPSS 1.6%