CVE-2024-42330
Published: 27 November 2024
Summary
CVE-2024-42330 is a critical-severity Use of Externally-Controlled Format String (CWE-134) vulnerability in Zabbix Zabbix. Its CVSS base score is 9.1 (Critical).
Operationally, ranked at the 46.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39876
Vulnerability details
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for…
more
JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.