CVE-2024-45699
published 2025-04-02CVE-2024-45699: The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection…
PriorityP424medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.34%
26.4th percentile
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | zabbix | < zabbix 1:5.0.46+dfsg-1+deb11u1 (bullseye) | zabbix 1:5.0.46+dfsg-1+deb11u1 (bullseye) |
| zabbix | zabbix | >= 0 < 1:5.0.46+dfsg-1+deb11u1 | 1:5.0.46+dfsg-1+deb11u1 |
| zabbix | zabbix | >= 0 < 1:7.0.9+dfsg-1 | 1:7.0.9+dfsg-1 |
| zabbix | zabbix | >= 0 < 1:7.0.9+dfsg-1 | 1:7.0.9+dfsg-1 |
| zabbix | zabbix | >= 6.0.0 < 6.0.37 | 6.0.37 |
| zabbix | zabbix | 6.0.0 – 6.0.36 | — |
| zabbix | zabbix | >= 6.4.0 < 6.4.21 | 6.4.21 |
| zabbix | zabbix | 6.4.0 – 6.4.20 | — |
| zabbix | zabbix | >= 7.0.0 < 7.0.7 | 7.0.7 |
| zabbix | zabbix | 7.0.0 – 7.0.6 | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv4.07.5HIGHCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2024-45699: zabbix - The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scrip...
vendor_debian·2024·CVSS 7.5
CVE-2024-45699 [HIGH] CVE-2024-45699: zabbix - The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scrip...
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
Scope: local
bookworm: open
bullseye: resolved (fixed in 1:5.0.46+dfsg-1+deb11u1)
forky: resolved (fixed in 1:7.0.9+dfsg-1)
sid: resolved (fixed in 1:7.0.9+dfsg-1)
trixie: resolved (fixed in 1:7.0.9+dfsg-1)
GHSA
GHSA-xc8w-x6qp-w4p7: The endpoint /zabbix
ghsa_unreviewed·2025-04-02
CVE-2024-45699 [HIGH] CWE-79 GHSA-xc8w-x6qp-w4p7: The endpoint /zabbix
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
OSV
CVE-2024-45699: The endpoint /zabbix
osv·2025-04-02·CVSS 7.5
CVE-2024-45699 [HIGH] CVE-2024-45699: The endpoint /zabbix
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
Suricata
ET WEB_SPECIFIC_APPS APsystems ECU-R Command Inject Attempt (CVE-2022-45699)
suricata·2024-11-05·CVSS 9.8
CVE-2022-45699 [CRITICAL] ET WEB_SPECIFIC_APPS APsystems ECU-R Command Inject Attempt (CVE-2022-45699)
ET WEB_SPECIFIC_APPS APsystems ECU-R Command Inject Attempt (CVE-2022-45699)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS APsystems ECU-R Command Inject Attempt (CVE-2022-45699)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:34; content:"/index.php/management/set_timezone"; fast_pattern; http.request_body; content:"timezone|3d|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,unit42.paloaltonetworks.com/mirai-variant-targets-iot-exploits/; reference:cve,2022-45699; classtype:attempted-admin; sid:2057254; rev:1; metadata:attack_target Networking_Equipment, tls_state plaintext, created_at 2024_11_05, cve CVE_2022_45699, deployment Perimeter, deployment Internal, performance
No public exploits indexed.
No writeups or analysis indexed.
2025-04-02
Published