Описание
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
A flaw was found in Zabbix. An authenticated user with limited administrative privileges can read raw server memory by leveraging the JavaScript preprocessing engine. This flaw leads to information disclosure, exposing sensitive data from other concurrently running preprocessor tasks that should not be accessible to that user.
Отчет
Red Hat does not ship Zabbix in any supported product. The community Fedora and EPEL packages are affected by this flaw and community trackers have been filed.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Дополнительная информация
Статус:
EPSS
4.9 Medium
CVSS3
Связанные уязвимости
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
The JavaScript preprocessing (Duktape) engine on Zabbix server has a v ...
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
ALT-PU-2026-19499: package `zabbix` update to version 7.0.32-alt0.p11.1
EPSS
4.9 Medium
CVSS3