CVE-2024-42332
published 2024-11-27CVE-2024-42332: The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have…
PriorityP414low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.63%
46.4th percentile
The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | zabbix | < zabbix 1:5.0.45+dfsg-1+deb11u1 (bullseye) | zabbix 1:5.0.45+dfsg-1+deb11u1 (bullseye) |
| zabbix | zabbix | >= 0 < 1:5.0.45+dfsg-1+deb11u1 | 1:5.0.45+dfsg-1+deb11u1 |
| zabbix | zabbix | >= 0 < 1:7.0.5+dfsg-1 | 1:7.0.5+dfsg-1 |
| zabbix | zabbix | >= 0 < 1:7.0.5+dfsg-1 | 1:7.0.5+dfsg-1 |
| zabbix | zabbix | >= 6.0.0 < 6.0.34 | 6.0.34 |
| zabbix | zabbix | >= 6.0.0 < 6.0.35 | 6.0.35 |
| zabbix | zabbix | >= 6.4.0 < 6.4.19 | 6.4.19 |
| zabbix | zabbix | >= 6.4.0 < 6.4.20 | 6.4.20 |
| zabbix | zabbix | >= 7.0.0 < 7.0.4 | 7.0.4 |
| zabbix | zabbix | >= 7.0.0 < 7.0.3 | 7.0.3 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
osv3.7LOW
vendor_debian3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-42332: The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and
osv·2024-11-27·CVSS 3.7
CVE-2024-42332 [LOW] CVE-2024-42332: The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and
The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host.
GHSA
GHSA-phjj-9p2g-26h9: The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and
ghsa_unreviewed·2024-11-27
CVE-2024-42332 [LOW] CWE-116 GHSA-phjj-9p2g-26h9: The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and
The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host.
Debian
CVE-2024-42332: zabbix - The researcher is showing that due to the way the SNMP trap log is parsed, an at...
vendor_debian·2024·CVSS 3.7
CVE-2024-42332 [LOW] CVE-2024-42332: zabbix - The researcher is showing that due to the way the SNMP trap log is parsed, an at...
The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host.
Scope: local
bookworm: open
bullseye: resolved (fixed in 1:5.0.45+dfsg-1+deb11u1)
forky: resolved (fixed in 1:7.0.5+dfsg-1)
sid: resolved (fixed in 1:7.0.5+dfsg-1)
trixie: resolved (fixed in 1:7.0.5+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-27
Published