PT-2024-9092 · Zabbix+4 · Zabbix+4

Vjaceslavs Bogdanovs · Published 2024-11-27 · Updated 2025-10-08 · CVE-2024-42330

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Zabbix (affected versions not specified)

Description: The issue is related to the use of uncontrolled format strings when processing HttpRequest objects, which can allow a remote attacker to gain unauthorized access to protected information. The problem lies in the fact that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript, allowing the creation of internal strings that can be used to access hidden properties of objects.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

ALT-PU-2024-16527

ALT-PU-2024-16638

ALT-PU-2025-3400

BDU:2024-10774

CVE-2024-42330

DLA-3984-1

Affected Products

Alt Linux

Astra Linux

Debian

Red Os

Zabbix

References · 32

• https://osv.dev/vulnerability/CVE-2024-42330 · Vendor Advisory
• https://support.zabbix.com/browse/ZBX-25626 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3984-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42330 · Security Note
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-42330 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42330 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10774 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-42330 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-42330 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-42330 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0411SE18 · Vendor Advisory