CVE-2024-36463

MEDIUM

Published Nov 26, 2024 Modified Oct 8, 2025 CWE-767

Description

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects.

Is your site exposed to CVE-2024-36463?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-767 CWE-767

Affected Products

Vendor	Product	Versions
zabbix	zabbix	5.0.0 — 5.0.43
zabbix	zabbix	6.0.0 — 6.0.33
zabbix	zabbix	6.4.0 — 6.4.18
zabbix	zabbix	7.0.0 — 7.0.3

References

Advisories & Patches

https://support.zabbix.com/browse/ZBX-25611

Frequently Asked Questions

What is CVE-2024-36463? +

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-36463? +

CVE-2024-36463 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-36463? +

CVE-2024-36463 affects products from zabbix, specifically: zabbix. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-36463? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-34162 5.3

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring …

CVE-2024-42327 9.9

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives …

CVE-2024-22116 9.9

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default …

CVE-2024-36461 9.1

Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.

CVE-2024-42330 9.1

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is …

CVE-2024-22120 9.1

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". …