PT-2024-6090 · Zabbix+2 · Zabbix+2

Justonezero · Published 2024-08-09 · Updated 2024-12-10 · CVE-2024-36462

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Zabbix versions prior to 7.0.0rc2

Description The issue is related to uncontrolled resource consumption, where an attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or degrade the performance of the affected system.

Recommendations For Zabbix versions prior to 7.0.0rc2, patch systems as soon as possible to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2024-12059

BDU:2024-06996

CVE-2024-36462

Affected Products

Alt Linux

Red Os

Zabbix

References · 23

• 🔥 https://github.com/W01fh4cker/CVE-2024-22120-RCE · Exploit
• 🔥 https://github.com/g4nkd/CVE-2024-22120-RCE-with-gopher · Exploit
• 🔥 https://github.com/isPique/CVE-2024-22120-RCE-with-gopher · Exploit
• https://support.zabbix.com/browse/ZBX-25019 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36462 · Security Note
• https://bdu.fstec.ru/vul/2024-06996 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-36462 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36462 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-36462 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-36462 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-36462 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-zabbix-10-09-24 · Note
• https://twitter.com/cracbot/status/1823238155132371177 · Twitter Post