CVE-2024-42330

published 2024-11-27

CVE-2024-42330: The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are…

Priority P3 50 critical 9.1 CVSS 3.1

AV N AC L PR H UI N S C C H I H A H

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	zabbix	< zabbix 1:5.0.45+dfsg-1+deb11u1 (bullseye)	zabbix 1:5.0.45+dfsg-1+deb11u1 (bullseye)
zabbix	zabbix	>= 0 < 1:5.0.45+dfsg-1+deb11u1	1:5.0.45+dfsg-1+deb11u1
zabbix	zabbix	>= 0 < 1:7.0.5+dfsg-1	1:7.0.5+dfsg-1
zabbix	zabbix	>= 0 < 1:7.0.5+dfsg-1	1:7.0.5+dfsg-1
zabbix	zabbix	>= 5.0.0 < 5.4.6	5.4.6
zabbix	zabbix	>= 6.0.0 < 6.0.34	6.0.34
zabbix	zabbix	6.0.0 – 6.0.33	—
zabbix	zabbix	>= 6.4.0 < 6.4.19	6.4.19
zabbix	zabbix	6.4.0 – 6.4.18	—
zabbix	zabbix	>= 7.0.0 < 7.0.4	7.0.4
zabbix	zabbix	7.0.0 – 7.0.3	—

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

osv 9.1 CRITICAL

vendor_debian 9.1 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-134