CVE-2024-22122

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-22122
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-22122.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-22122
Downstream
Published
2024-08-12T13:38:16Z
Modified
2026-10-16T02:54:12Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "5.0.0"
                        },
                        {
                            "last_affected": "5.0.42"
                        },
                        {
                            "introduced": "6.4.0"
                        },
                        {
                            "last_affected": "6.4.15"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "zabbix:zabbix"
        }
    ]
}
References

Affected packages

Git / github.com/zabbix/zabbix

Affected ranges

Type
GIT
Repo
https://github.com/zabbix/zabbix
Events
Introduced
5203d2ea7d901cd33d148f20586e2155901a7faa
Last Affected
680df722d6b72279a2fca65717fa113bfa9c48bc
Introduced
aef542ad8aef472874199012f9b2350db16dc7ee
Last Affected
b6bea25de214bef475bcb907f27f68d4457d55b1
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.0.0"
                },
                {
                    "last_affected": "6.0.30"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-alpha1"
                },
                {
                    "last_affected": "7.0.0-alpha1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-alpha2"
                },
                {
                    "last_affected": "7.0.0-alpha2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-alpha3"
                },
                {
                    "last_affected": "7.0.0-alpha3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-alpha4"
                },
                {
                    "last_affected": "7.0.0-alpha4"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-alpha5"
                },
                {
                    "last_affected": "7.0.0-alpha5"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-alpha6"
                },
                {
                    "last_affected": "7.0.0-alpha6"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-alpha7"
                },
                {
                    "last_affected": "7.0.0-alpha7"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-alpha8"
                },
                {
                    "last_affected": "7.0.0-alpha8"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-alpha9"
                },
                {
                    "last_affected": "7.0.0-alpha9"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-beta1"
                },
                {
                    "last_affected": "7.0.0-beta1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-beta2"
                },
                {
                    "last_affected": "7.0.0-beta2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-beta3"
                },
                {
                    "last_affected": "7.0.0-beta3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:rc1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-rc1"
                },
                {
                    "last_affected": "7.0.0-rc1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:zabbix:zabbix:7.0.0:rc2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0-rc2"
                },
                {
                    "last_affected": "7.0.0-rc2"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

6.*
6.0.0
6.0.1
6.0.10
6.0.10rc1
6.0.10rc2
6.0.11
6.0.11rc1
6.0.11rc2
6.0.12
6.0.12rc1
6.0.12rc2
6.0.13
6.0.13rc1
6.0.14
6.0.14rc1
6.0.14rc2
6.0.15
6.0.15rc1
6.0.15rc2
6.0.16
6.0.16rc1
6.0.17
6.0.17rc1
6.0.17rc2
6.0.18
6.0.18rc1
6.0.19
6.0.19rc1
6.0.1rc1
6.0.1rc2
6.0.1rc3
6.0.1rc4
6.0.2
6.0.20
6.0.20rc1
6.0.21
6.0.21rc1
6.0.22
6.0.22rc1
6.0.23
6.0.23rc1
6.0.25
6.0.25rc1
6.0.26
6.0.26rc1
6.0.27
6.0.27rc1
6.0.28
6.0.28rc1
6.0.29
6.0.29rc1
6.0.2rc1
6.0.3
6.0.30
6.0.30rc1
6.0.3rc1
6.0.4
6.0.4rc1
6.0.5
6.0.5rc1
6.0.6
6.0.6rc1
6.0.7
6.0.7rc1
6.0.8
6.0.8rc1
6.0.8rc2
6.0.9
6.0.9rc1
6.0.9rc2
7.*
7.0.0-alpha1
7.0.0-alpha2
7.0.0-alpha3
7.0.0-alpha4
7.0.0-alpha5
7.0.0-alpha6
7.0.0-alpha7
7.0.0-alpha8
7.0.0-alpha9
7.0.0-beta1
7.0.0-beta2
7.0.0-beta3
7.0.0-rc1
7.0.0-rc2
7.0.0alpha1
7.0.0alpha2
7.0.0alpha3
7.0.0alpha4
7.0.0alpha6
7.0.0alpha7
7.0.0alpha8
7.0.0alpha9
7.0.0beta1
7.0.0beta2
7.0.0beta3
7.0.0rc1
7.0.0rc2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-22122.json"