Applications stack vulnerabilities · Page 7

CVE-2024-10452

Organization admins can delete pending invites created in an organization they are not part of.

Grafana SQL Expressions allow for remote code execution

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

• Update to 11.0.6
• Update to 11.1.7
• Update to 11.2.2

Grafana alerting wrong permission on datasource rule write endpoint

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

• Update to 10.3.10
• Update to 10.4.9
• Update to 11.0.5
• Update to 11.1.6
• Update to 11.2.1

CVE-2024-6322

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.

• Update to 11.1.1
• Update to 11.1.3

Zabbix Arbitrary File Read

Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.

• Update to 1:7.0.0+dfsg-1
• Update to 5.0.43rc1
• Update to 6.0.31rc1
• Update to 6.4.16rc1
• Update to 7.0.0rc3

Remote code execution within ping script

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

• Update to 1:7.0.0+dfsg-1
• Update to 6.4.16rc1
• Update to 7.0.0rc3

System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission

User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.

• Update to 1:7.0.0+dfsg-1
• Update to 5.0.43rc1
• Update to 6.0.31rc1
• Update to 6.4.16rc1
• Update to 7.0.0rc3

Allocation of resources without limits or throttling (uncontrolled resource consumption)

Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or degrade the performance of the affected system.

• Update to 1:7.0.1+dfsg-1
• Update to 7.0.0rc3

Direct access to memory pointers within the JS engine for modification

Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.

• Update to 1:7.0.1+dfsg-1
• Update to 6.0.31rc1
• Update to 6.4.16rc1
• Update to 7.0.1rc1

Front-end audit log shows passwords in plaintext

The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.

• Update to 1:7.0.1+dfsg-1
• Update to 5.0.43rc1
• Update to 6.0.31rc1
• Update to 6.4.16rc1
• Update to 7.2.0alpha1

AT(GSM) Command Injection

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

• Update to 1:7.0.0+dfsg-1
• Update to 5.0.43rc1
• Update to 6.0.31rc1
• Update to 6.4.16rc1
• Update to 7.0.0rc3

Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.

• Update to 5.0.43rc1
• Update to 6.0.31rc1
• Update to 6.4.16rc1
• Update to 7.0.0rc3

CVE-2024-21147

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or

• Update to 11.0.24+8-1ubuntu3~20.04
• Update to 11.0.25+9-1ubuntu1~18.04
• Update to 17.0.12+7-1ubuntu2~20.04
• Update to 17.0.12+7-1ubuntu2~22.04
• Update to 17.0.12+7-2~deb12u1
• Update to 17.0.13+11-2ubuntu1~18.04.2
• Update to 21.0.3+9-1
• Update to 21.0.4+7-1ubuntu2~20.04
• Update to 8u422-b05-1~18.04
• Update to 8u422-b05-1~20.04
• Update to 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21145

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete a

• Update to 11.0.24+8-1ubuntu3~20.04
• Update to 11.0.25+9-1ubuntu1~18.04
• Update to 17.0.12+7-1ubuntu2~20.04
• Update to 17.0.12+7-1ubuntu2~22.04
• Update to 17.0.12+7-2~deb12u1
• Update to 17.0.13+11-2ubuntu1~18.04.2
• Update to 21.0.3+9-1
• Update to 21.0.4+7-1ubuntu2~20.04
• Update to 8u422-b05-1~18.04
• Update to 8u422-b05-1~20.04
• Update to 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21144

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability ap

• Update to 11.0.24+8-1ubuntu3~20.04
• Update to 11.0.24+8-1ubuntu3~22.04
• Update to 11.0.24+8-2~deb11u1
• Update to 11.0.25+9-1ubuntu1~18.04
• Update to 8u422-b05-1~18.04
• Update to 8u422-b05-1~20.04
• Update to 8u422-b05-1~22.04
• Update to 8u422-b05-1~24.04
• Update to 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21140

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or del

• Update to 11.0.24+8-1ubuntu3~20.04
• Update to 11.0.25+9-1ubuntu1~18.04
• Update to 17.0.12+7-1ubuntu2~20.04
• Update to 17.0.12+7-1ubuntu2~22.04
• Update to 17.0.12+7-2~deb12u1
• Update to 17.0.13+11-2ubuntu1~18.04.2
• Update to 21.0.3+9-1
• Update to 21.0.4+7-1ubuntu2~20.04
• Update to 8u422-b05-1~18.04
• Update to 8u422-b05-1~20.04
• Update to 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21138

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a par

• Update to 11.0.24+8-1ubuntu3~20.04
• Update to 11.0.25+9-1ubuntu1~18.04
• Update to 17.0.12+7-1ubuntu2~20.04
• Update to 17.0.12+7-1ubuntu2~22.04
• Update to 17.0.12+7-2~deb12u1
• Update to 17.0.13+11-2ubuntu1~18.04.2
• Update to 21.0.3+9-1
• Update to 21.0.4+7-1ubuntu2~20.04
• Update to 8u422-b05-1~18.04
• Update to 8u422-b05-1~20.04
• Update to 8u432-ga~us1-0ubuntu2~16.04.4

CVE-2024-21131

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or del

• Update to 11.0.24+8-1ubuntu3~20.04
• Update to 11.0.25+9-1ubuntu1~18.04
• Update to 17.0.12+7-1ubuntu2~20.04
• Update to 17.0.12+7-1ubuntu2~22.04
• Update to 17.0.12+7-2~deb12u1
• Update to 17.0.13+11-2ubuntu1~18.04.2
• Update to 21.0.3+9-1
• Update to 21.0.4+7-1ubuntu2~20.04
• Update to 8u422-b05-1~18.04
• Update to 8u422-b05-1~20.04
• Update to 8u432-ga~us1-0ubuntu2~16.04.4

Time Based SQL Injection in Zabbix Server Audit Log

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

• Update to 1:6.0.29+dfsg-1
• Update to 6.0.28rc1
• Update to 6.4.13rc1
• Update to 7.0.0beta1

CVE-2024-21094

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete acces

• Update to 11.0.23+9-1ubuntu1~18.04.1
• Update to 11.0.23+9-1ubuntu1~20.04.2
• Update to 17.0.11+9-1~18.04.1
• Update to 17.0.11+9-1~20.04.2
• Update to 17.0.11+9-1~22.04.1
• Update to 17.0.11+9-1~deb12u1
• Update to 21.0.3+9-1
• Update to 21.0.3+9-1ubuntu1~20.04.1
• Update to 8u412-ga-1~18.04.1
• Update to 8u412-ga-1~20.04.1
• Update to 8u432-ga~us1-0ubuntu2~16.04.4