CVE-2024-42330

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://support.zabbix.com/browse/ZBX-25626	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zabbix:zabbix::::::::
	cpe:2.3:a:zabbix:zabbix::::::::
	cpe:2.3:a:zabbix:zabbix::::::::
	cpe:2.3:a:zabbix:zabbix::::::::

History

08 Oct 2025, 15:14

Type	Values Removed	Values Added
First Time		Zabbix zabbix Zabbix
References	~~() https://support.zabbix.com/browse/ZBX-25626 -~~	() https://support.zabbix.com/browse/ZBX-25626 - Vendor Advisory
CPE		cpe:2.3:a:zabbix:zabbix::::::::

27 Nov 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-27 12:15

Updated : 2025-10-08 15:14

NVD link : CVE-2024-42330

Mitre link : CVE-2024-42330

CVE.ORG link : CVE-2024-42330

JSON object : View

Products Affected

zabbix

zabbix

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2024-42330", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@zabbix.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2024-11-27T12:15:21.007", "references": [{"url": "https://support.zabbix.com/browse/ZBX-25626", "tags": ["Vendor Advisory"], "source": "security@zabbix.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@zabbix.com", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects."}, {"lang": "es", "value": "El objeto HttpRequest permite obtener los encabezados HTTP de la respuesta del servidor despu\u00e9s de enviar la solicitud. El problema es que las cadenas devueltas se crean directamente a partir de los datos devueltos por el servidor y no est\u00e1n codificadas correctamente para JavaScript. Esto permite crear cadenas internas que se pueden usar para acceder a propiedades ocultas de los objetos."}], "lastModified": "2025-10-08T15:14:30.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E60C568B-C993-4F05-9875-055745A5FC25", "versionEndExcluding": "5.4.6", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45CB467C-BC4C-4455-83A5-9FBA0CC7AEA6", "versionEndExcluding": "6.0.34", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EC3DDAA-D910-423D-B07D-5BBFC2584A41", "versionEndExcluding": "6.4.19", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC284EF6-B253-4383-8278-EB81F7859AEF", "versionEndExcluding": "7.0.4", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@zabbix.com"}