CVE-2024-22116

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-221172.2When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the CVE-2024-221195.4The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.CVE-2024-22127.8In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compati CVE-2024-221208.8Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "CVE-2024-221216.1A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability CVE-2024-221229.1Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" fiel CVE-2024-221232.7Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possi CVE-2024-221247.5Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL6 CVE-2024-221257.5Under certain conditions the Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) - version 1.0, allows an attacker to ac CVE-2024-221266.1The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL par CVE-2024-221279.1SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload pot CVE-2024-221286.1SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, doe