CVE-2024-42330

JS - Internal strings in HTTP headers

State: Published
Severity: 9.1 Critical
Published: Nov 27, 2024
Updated: Nov 3, 2025
Reserved: Jul 30, 2024

Description

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	Zabbix

Weaknesses

CWE-134 Use of Externally-Controlled Format String

Affected Products

Product	Versions
ZabbixZabbix	6.0.0 through 6.0.33Affectedfrom 6.0.34rc1Not affected 6.4.0 through 6.4.18Affectedfrom 6.4.19rc1Not affected 7.0.0 through 7.0.3Affectedfrom 7.0.4rc1Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.