CVE-2024-45699: 
Zabbix Server vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in Zabbix affecting the endpoint /zabbix.php?action=export.valuemaps through the backurl parameter. The vulnerability was disclosed on April 1, 2025, and was assigned CVE-2024-45699. The issue stems from improper handling of user-supplied data without appropriate HTML escaping or output encoding (NVD, Zabbix Support).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and received a CVSS 4.0 Base Score of 7.5 (HIGH) with the vector string CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The issue occurs when user-supplied data in the backurl parameter is reflected without proper sanitization, allowing JavaScript payload injection (NVD).

When successfully exploited, this vulnerability allows attackers to execute arbitrary JavaScript code within the context of the victim's browser session. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the authenticated user (NVD).

The vulnerability requires no authentication to exploit but does need user interaction. The attack complexity is rated as high according to the CVSS score, indicating that specific conditions need to be met for successful exploitation (NVD).

The vulnerability has been reported and tracked in Zabbix's bug tracking system under ZBX-26254. Users should apply any available security updates once released by Zabbix to address this vulnerability (Zabbix Support).

The vulnerability has been acknowledged by the security community, with multiple security platforms reporting on the issue. Red Hat has evaluated the vulnerability and determined it does not affect any currently supported Red Hat products (Red Hat Portal, Security Online).