CVE-2024-42330: JS - Internal strings in HTTP headers
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42330?
CVE-2024-42330 has not been explicitly rated yet but may allow for cross-site scripting attacks due to improper encoding.
How do I fix CVE-2024-42330?
To fix CVE-2024-42330, ensure that you are using an updated version of Zabbix that corrects the improper encoding issue.
What versions of Zabbix are affected by CVE-2024-42330?
CVE-2024-42330 affects Zabbix versions from 5.0.0 to 5.4.6, 6.0.0 to 6.0.34, 6.4.0 to 6.4.19, and 7.0.0 to 7.0.4.
Can CVE-2024-42330 lead to data exposure?
Yes, CVE-2024-42330 can potentially lead to data exposure through cross-site scripting vulnerabilities.
Are there any known exploits for CVE-2024-42330?
As of now, there have been no widely reported exploits for CVE-2024-42330, but the vulnerability poses a risk.