CVE-2024-22121 Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe

What is CVE-2024-22121?

CVE-2024-22121 is a medium-severity vulnerability in Zabbix Zabbix, published on 9 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.

Weakness: CWE-281

Which versions are affected by CVE-2024-22121?

It affects 1 product.

Products include Zabbix Zabbix.

How do I fix CVE-2024-22121?

No fix has been published for CVE-2024-22121 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-22121 being exploited?

There is no known exploitation of CVE-2024-22121 in the wild and no public exploit code.

Other vulnerabilities in Zabbix Zabbix

• CVE-2022-23131 Zabbix Frontend Authentication Bypass Exploited Critical 9.1
• CVE-2007-0640 Memory corruption in n/a Critical 10.0
• CVE-2024-42327 SQL injection in user.get API Critical 9.9
• CVE-2024-22116 Remote code execution within ping script Critical 9.9
• CVE-2013-3738 Code injection in n/a Critical 9.8

All Zabbix Zabbix vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mmh3-p6qg-xhw2, UBUNTU-CVE-2024-22121.