CVE-2024-22117 Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added
Attackers can prevent other users from adding URLs to map elements by manipulating internal ID counters, causing a denial of service for that feature.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22117?
CVE-2024-22117 is a low-severity vulnerability in Zabbix Zabbix, published on 26 Nov 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element.
Weakness: CWE-20
Which versions are affected by CVE-2024-22117?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2024-22117?
Apply the vendor's patch.
Is CVE-2024-22117 being exploited?
There is no known exploitation of CVE-2024-22117 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2024-22117, GHSA-vmrp-q2j9-gmqr, UBUNTU-CVE-2024-22117.