Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-42330
CVE-2024-42330:
Zabbix Server vulnerability analysis and mitigation
Overview
A critical vulnerability (CVE-2024-42330) has been identified in Zabbix, a popular open-source monitoring tool. The vulnerability affects multiple versions of Zabbix including versions 6.0.0 through 6.0.33, 6.4.0 through 6.4.18, and 7.0.0 through 7.0.3. The issue was discovered by security researcher 'zhutyra' through the HackerOne bug bounty platform and has been assigned a critical CVSS score of 9.1 (SecurityOnline).
Technical details
The vulnerability stems from improper encoding of HTTP headers in the HttpRequest object. Specifically, the returned strings are created directly from the data returned by the server without proper JavaScript encoding. This implementation flaw allows attackers to create internal strings that can be used to access hidden properties of objects. The vulnerability has been classified under CWE-134 (Use of Externally-Controlled Format String) (NVD, Zabbix Support).
Impact
The vulnerability has been rated as Critical with a CVSS v3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). This high severity rating indicates that successful exploitation could lead to significant compromise of the affected systems, potentially allowing attackers to execute arbitrary code on vulnerable systems (SecurityOnline).
Mitigation and workarounds
Zabbix has released patched versions to address this vulnerability: 6.0.34rc1, 6.4.19rc1, and 7.0.4rc1. Organizations using affected versions are strongly urged to update to these latest releases immediately to mitigate the security risk (ASEC).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management