The implementation of atob in Zabbix JS allows to create a string with arbitrary content and use it to access internal properties of objects.
Weakness
The product defines a public method that reads or modifies a private variable.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Zabbix | Zabbix | 5.0.0 (including) | 5.0.43 (excluding) |
| Zabbix | Zabbix | 6.0.0 (including) | 6.0.33 (excluding) |
| Zabbix | Zabbix | 6.4.0 (including) | 6.4.18 (excluding) |
| Zabbix | Zabbix | 7.0.0 (including) | 7.0.3 (excluding) |
| Zabbix | Ubuntu | focal | * |
| Zabbix | Ubuntu | oracular | * |
| Zabbix | Ubuntu | trusty/esm | * |
| Zabbix | Ubuntu | upstream | * |