CVE-2024-42328 JS - Crash on empty HTTP server response
An attacker can cause a denial of service in Zabbix by sending an empty HTTP response to the webdriver, triggering a null pointer dereference crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42328?
CVE-2024-42328 is a low-severity vulnerability in Zabbix Zabbix, published on 27 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is an empty document, then wd->data in the code below will remain NULL and an attempt to read from it will result in a crash.
Which versions are affected by CVE-2024-42328?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2024-42328?
Apply the vendor's patch.
Is CVE-2024-42328 being exploited?
There is no known exploitation of CVE-2024-42328 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2024-42328, GHSA-3m8p-v336-pmqp, UBUNTU-CVE-2024-42328.