CVE-2024-22116: RCE in Monitoring Ping Script via Code Injection

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: CVE-2024-22116 2. Vulnerability Type: Defect (Security) 3. Priority: Critical 4. Affected Versions: 6.4.15, 7.0.0rc2 5. Component: Server (S) 6. Vulnerability Description: - Mitre ID: CVE-2024-22116 - CVSS Score: 9.9 - CVSS Vector: https://www.first.org/cvss/calculator/3.1#AV:N/AC:L/PR:L/UI:N - Severity: Critical - Summary: Remote code execution within ping script - Description: An administrator with limited privileges can exploit the script execution feature in the monitoring host section. The lack of a default parameter allows users to execute arbitrary code via the ping script, enabling attacks through compromised infrastructure. 7. Vulnerability Classification: - Common Weakness Enumeration (CWE): CWE-94 Improper Control of Generation of Code ('Code Injection') - Common Attack Pattern Enumeration and Classification (CAPEC): CAPEC-253 Remote Code Inclusion 8. Known Attack Vector: Compromise of the monitoring environment 9. Remediation Status: - Fixed Versions: 6.4.16rc1, 7.0.0rc3 - Fix Compatibility Testing: None - Fix Status: Fixed This information helps in understanding the detailed nature of the vulnerability, its scope of impact, and the remediation measures.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-22116: RCE in Monitoring Ping Script via Code Injection