Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-36464
CVE-2024-36464:
Zabbix Server vulnerability analysis and mitigation
Overview
CVE-2024-36464 is a security vulnerability in Zabbix that involves the exposure of plaintext passwords during media type exports. The vulnerability was discovered and disclosed in November 2024, affecting various versions of Zabbix. When users export media types, the associated passwords are exported in YAML format without encryption, potentially exposing sensitive credentials (Debian Tracker, Zabbix Support).
Technical details
The vulnerability is classified as a best practices issue where the media type export functionality in Zabbix exports passwords in plaintext within YAML files. This security flaw affects the frontend component of Zabbix and has been addressed in versions 6.0.30rc1 and 6.4.15rc1 (Zabbix Support).
Impact
The exposure of plaintext passwords in exported YAML files could potentially lead to unauthorized access to media type configurations and compromise of associated services if the exported files are accessed by malicious actors (Debian Tracker).
Mitigation and workarounds
The vulnerability has been fixed in Zabbix versions 6.0.30rc1 and 6.4.15rc1. Users are advised to upgrade to these or later versions to address the security issue. The fix has also been backported to various distributions, including Debian, where version 1:5.0.45+dfsg-1+deb11u1 contains the security fix (Debian Tracker).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management