CVE-2024-22121

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-281

Affected software

Vendor	Product	Versions
Zabbix	Zabbix	>= 5.0.0, <= 5.0.42; >= 6.0.0, <= 6.0.30; >= 6.4.0, <= 6.4.15; >= 7.0.0alpha1, <= 7.0.0rc2

References

https://support.zabbix.com/browse/ZBX-25011Vendor Advisory

Timeline

Published: Aug 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-221229.1Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" fiel CVE-2024-221232.7Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possi CVE-2024-221247.5Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL6 CVE-2024-221257.5Under certain conditions the Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) - version 1.0, allows an attacker to ac CVE-2024-221266.1The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL par CVE-2024-221279.1SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload pot CVE-2024-221286.1SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, doe CVE-2024-221297.6SAP Companion - version <3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link t CVE-2024-22133.3An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with a CVE-2024-221305.4Print preview option in SAP CRM WebClient UI - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF CVE-2024-221317.2In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remot CVE-2024-221326.3SAP IDES ECC-systems contain code that permits the execution of arbitrary program code of user's choice.An attacker can therefore control th