CVE-2024-22119 Stored XSS in graph items select form
Attackers can inject malicious scripts via the Name field in Graph items, potentially leading to session hijacking or code execution in Zabbix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-22119?
CVE-2024-22119 is a medium-severity cross-site scripting vulnerability in Zabbix Zabbix, published on 9 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.
Which versions are affected by CVE-2024-22119?
It affects 1 product.
Linux distribution packages (4)
zabbix SUSE:Linux Enterprise Server 12 SP5 | All versions | 4.0.12-4.27.1 |
zabbix SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 4.0.12-4.27.1 |
zabbix SUSE:Package Hub 15 SP5 | All versions | 4.0.50-bp155.3.12.1 |
zabbix openSUSE:Leap 15.5 | All versions | 4.0.50-bp155.3.12.1 |
Products include Zabbix Zabbix.
How do I fix CVE-2024-22119?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-22119 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22119 exists.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2024-22119, DLA-3798-1, GHSA-8w8q-863g-6gx9, SUSE-SU-2024:0862-1, UBUNTU-CVE-2024-22119, openSUSE-SU-2024:0064-1.