CVE-2024-42330: zabbix — Fix

Description

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.

Is your site exposed to CVE-2024-42330?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-134 CWE-134

Affected Products

Vendor	Product	Versions
zabbix	zabbix	5.0.0 — 5.4.6
zabbix	zabbix	6.0.0 — 6.0.34
zabbix	zabbix	6.4.0 — 6.4.19
zabbix	zabbix	7.0.0 — 7.0.4

References

Advisories & Patches

https://support.zabbix.com/browse/ZBX-25626

Other References

https://lists.debian.org/debian-lts-announce/2024/12/msg00005.html

Frequently Asked Questions

What is CVE-2024-42330? +

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects. It has a CVSS v3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2024-42330? +

CVE-2024-42330 has a CVSS v3.1 score of 9.1 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-42330? +

CVE-2024-42330 affects products from zabbix, specifically: zabbix. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-42330? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-10828

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort …

CVE-2026-6242

An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of …

CVE-2012-10055

ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending …

CVE-2011-10029

Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing …

CVE-2024-9129

In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan …

CVE-2026-6241

An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly …

CVE-2024-42330