Cyber Resilience

CVE-2024-36463

Zabbix 5.0.0 – 5.0.43

Published
26 November 2024
Modified
08 October 2025
Patch / advisory
View advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0080 53th percentile
Risk Priority 52 floored blend · peak EPSS

Summary

CVE-2024-36463 is a medium-severity Access to Critical Private Variable via Public Method (CWE-767) vulnerability in Zabbix Zabbix. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects.

CWE(s)
CWE-767

Related Threats

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-42333Same product: Zabbix Zabbix
CVE-2024-22114Same product: Zabbix Zabbix
CVE-2024-22121Same product: Zabbix Zabbix
CVE-2024-36464Same product: Zabbix Zabbix
CVE-2024-42325Same product: Zabbix Zabbix
CVE-2023-29450Same product: Zabbix Zabbix
CVE-2024-36460Same product: Zabbix Zabbix
CVE-2025-27231Same product: Zabbix Zabbix
CVE-2024-36467Same product: Zabbix Zabbix
CVE-2023-32723Same product: Zabbix Zabbix

Affected Assets

zabbix
zabbix
5.0.0 — 5.0.43 · 6.0.0 — 6.0.33 · 6.4.0 — 6.4.18

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Access enforcement directly stops public methods from reading or writing private variables by requiring explicit authorization checks on every access.

AC-6 Least Privilege good match

Least privilege limits which code paths may touch critical variables, reducing the chance that an overly broad public method can reach them.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent public exposure of private variables via code review, static analysis, and encapsulation standards.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect improper exposure of private variables during acceptance.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle mandates encapsulation and access-control design practices.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify that private variables must remain inaccessible.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles enforce encapsulation and least-privilege data access.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly forbid exposing private variables through public methods.

A.8.3 Information access restriction partial match
degrades

Information access restriction directly prevents public methods from exposing private variables.

References