CVE-2024-42330

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-134

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-423313.3In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap p CVE-2024-423323.7The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of infor CVE-2024-423332.7The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedi CVE-2024-423355.47Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-423369.8Servision - CWE-287: Improper Authentication CVE-2024-423376.5CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-423384.3CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-423394.3CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-42345.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayful Islam Filterable Portfolio allo CVE-2024-423404.3CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security CVE-2024-423416.1Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-423424.3Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')