Vulnerability in HttpRequest Object Could Allow Access to Hidden Properties
CVE-2024-42330

9.1CRITICAL

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
27 November 2024

What is CVE-2024-42330?

An encoding vulnerability in Zabbix Server's HttpRequest object allows the retrieval of raw HTTP headers from server responses without proper encoding for JavaScript. This flaw permits the crafting of internal strings that can access hidden properties of objects, leading to potential unauthorized actions and data exposure. Users of Zabbix Server versions 5.0.0 to 6.0.5 are particularly at risk, emphasizing the need for immediate remedial actions.

Affected Version(s)

Zabbix 6.0.0 <= 6.0.33

Zabbix 6.4.0 <= 6.4.18

Zabbix 7.0.0 <= 7.0.3

References

https://support.zabbix.com/browse/ZBX-25626

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

Credit

Zabbix wants to thank zhutyra for submitting this report on the HackerOne bug bounty platform.
.