by Kastro
Paper/Archive/CVE-2024-36461

CVE-2024-36461

Zabbix Zabbix — Direct access to memory pointers within the JS engine for modification

EPSS 0.8%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 55.1.551 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.

Affected

ProductAffectedFixed inSource
Zabbix6.0.0 – 6.0.30–CNA
Zabbix6.4.0 – 6.4.15–CNA
Zabbix7.0.0alpha1 – 7.0.0–CNA

Scores by source

Zabbix (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsupport.zabbix.com/browse/ZBX-25018reflists.debian.org/debian-lts-announce/2024/10/msg00000.html