p PatchFirst

CVE-2024-22119

CVE-2024-22119 · Stored XSS in graph items select form

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.

CVSS 5.5 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: system · applications

Affected products and versions

  • zabbix

    Versions
    • ≥ 5.0.0, ≤ 5.0.39: Affected; ≥ 5.0.40rc1: Not affected (git)
    • ≥ 6.0.0, ≤ 6.0.23: Affected; ≥ 6.0.24rc1: Not affected (git)
    • ≥ 6.4.0, ≤ 6.4.8: Affected; ≥ 6.4.9rc1: Not affected (git)
    • ≥ 7.0.0alpha1, ≤ 7.0.0alpha7: Affected; ≥ 7.0.0alpha8: Not affected (git)

    Update to 5.0.40rc1; Update to 6.0.24rc1; Update to 6.4.9rc1; Update to 7.0.0alpha8

  • zabbix Debian:12

    Versions
    • 1:6.0.14+dfsg-1
    • 1:6.0.23+dfsg-1
    • 1:6.0.23+dfsg-1~bpo12+1
    • 1:6.0.24+dfsg-1
    • 1:6.0.25+dfsg-1
    • 1:6.0.29+dfsg-1
    • 1:7.0.0+dfsg-1
    • 1:7.0.0+dfsg-2
    • 1:7.0.0+dfsg-2~bpo12+1
    • 1:7.0.1+dfsg-1
    • 1:7.0.1+dfsg-1~bpo12+1
    • 1:7.0.10+dfsg-1
    • 1:7.0.10+dfsg-2
    • 1:7.0.2+dfsg-1
    • 1:7.0.2+dfsg-1~bpo12+1
    • 1:7.0.22+dfsg-1
    • 1:7.0.22+dfsg-1.1
    • 1:7.0.22+dfsg-1~bpo13+1
    • 1:7.0.22+dfsg-1~deb13u1
    • 1:7.0.27+dfsg-1
    • 1:7.0.29+dfsg-1
    • 1:7.0.29+dfsg-2
    • 1:7.0.3+dfsg-1
    • 1:7.0.5+dfsg-1
    • 1:7.0.5+dfsg-1~bpo12+1
    • 1:7.0.6+dfsg-1
    • 1:7.0.9+dfsg-1
    • 1:7.0.9+dfsg-1~bpo12+1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:6.0.24+dfsg-1

    Update to 1:6.0.24+dfsg-1

  • zabbix Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:6.0.24+dfsg-1

    Update to 1:6.0.24+dfsg-1

  • zabbix Ubuntu:Pro:22.04:LTS

    Versions
    • 1:5.0.8+dfsg-1build1
    • 1:5.0.14+dfsg-1
    • 1:5.0.17+dfsg-1
    • 1:5.0.17+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:25.10

    Versions
    • 1:7.0.10+dfsg-2
    • 1:7.0.10+dfsg-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:26.10

    Versions
    • 1:7.0.22+dfsg-1
    • 1:7.0.22+dfsg-1.1
    • 1:7.0.22+dfsg-1.1build1
    • 1:7.0.22+dfsg-1.1build2
    • 1:7.0.27+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:26.04:LTS

    Versions
    • 1:7.0.10+dfsg-2build1
    • 1:7.0.22+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →