CVE-2024-45699: Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45699?
CVE-2024-45699 is classified as a medium-severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2024-45699?
To fix CVE-2024-45699, ensure proper HTML escaping and output encoding of the backurl parameter in the /zabbix.php?action=export.valuemaps endpoint.
Who is affected by CVE-2024-45699?
CVE-2024-45699 affects users of Zabbix software that utilize the vulnerable endpoint.
What type of vulnerability is CVE-2024-45699?
CVE-2024-45699 is a Cross-Site Scripting (XSS) vulnerability that allows for the injection of JavaScript payloads.
What impact does CVE-2024-45699 have?
The impact of CVE-2024-45699 can lead to unauthorized script execution in the context of a user's browser, potentially compromising user data.