CVE-2024-42326: 
Zabbix Server vulnerability analysis and mitigation

A use-after-free vulnerability was discovered in the es_browser_get_variant function within browser.c component of Zabbix. The vulnerability was assigned CVE-2024-42326 and was disclosed on November 27, 2024. This security flaw affects Zabbix software versions starting from 7.0.0rc1 (Debian Tracker).

The vulnerability is classified as CWE-416 (Use After Free) and has been assigned a CVSS v3.1 base score of 4.4 (MEDIUM) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L. The issue specifically occurs in the es_browser_get_variant function within the browser.c file, which is part of the webdriver functionality introduced in Zabbix 7.0.0rc1 (NVD).

Based on the CVSS score and vector, the vulnerability has local impact with low privileges required for exploitation. It affects both confidentiality and availability at a low level, while having no impact on integrity (NVD).

The vulnerability requires local access and low privileges to exploit, with no user interaction needed. The attack complexity is considered low according to the CVSS metrics (NVD).

The vulnerability has been fixed in Zabbix version 7.0.4rc1. The fix was implemented through commit 0b01b889fc1d47002e1cf9fa50d52a5cca5f1a97. Earlier versions of Zabbix (pre-7.0.0rc1) are not affected as the vulnerable code was introduced with commit 4d22c15fe4499602e0da5399e3dd6dc9da03277b in version 7.0.0rc1 (Debian Tracker).