CVE-2024-22117
Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added
Severity Score
2.2
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element.
*Credits:
Zabbix wants to thank prasetia (prasetia) for submitting this report on the HackerOne bug bounty platform
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-01-05 CVE Reserved
- 2024-11-26 CVE Published
- 2024-11-26 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
- CAPEC-207: Removing Important Client Functionality
References (1)
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Zabbix Search vendor "Zabbix" | Zabbix Search vendor "Zabbix" for product "Zabbix" | >= 6.0.0 <= 6.0.33 Search vendor "Zabbix" for product "Zabbix" and version " >= 6.0.0 <= 6.0.33" | en |
Affected
| ||||||
| Zabbix Search vendor "Zabbix" | Zabbix Search vendor "Zabbix" for product "Zabbix" | >= 6.4.0 <= 6.4.18 Search vendor "Zabbix" for product "Zabbix" and version " >= 6.4.0 <= 6.4.18" | en |
Affected
| ||||||
| Zabbix Search vendor "Zabbix" | Zabbix Search vendor "Zabbix" for product "Zabbix" | >= 7.0.0 <= 7.0.3 Search vendor "Zabbix" for product "Zabbix" and version " >= 7.0.0 <= 7.0.3" | en |
Affected
| ||||||