Insufficiently protected credentials in Zabbix - CVE-2024-36464
Published: December 5, 2024
Vulnerability identifier: #VU101271
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-36464
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to gain access to media types credential.
The vulnerability exists due to media types credentials are exported in the yaml format in plain text. A remote attacker with access to exported data can obtain the credentials.
Affected software
Zabbix
How to mitigate CVE-2024-36464
Install updates from vendor's website.
Zabbix - addressed in versions 6.0.30 rc1, 6.4.15 rc1