CVE-2024-36464: Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported

Severity: low (CVSS 2.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-27 · updated 2026-06-17
Weakness: CWE-256

Description

When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords.

Affected products

Zabbix: from 6.0.0 before 6.0.30; from 6.4.0 before 6.4.15 — fixed in 6.0.30, 6.4.15

How to fix

Upgrade to a fixed version: Zabbix 6.0.30, 6.4.15. Check the vendor advisory for mitigations.

References

https://support.zabbix.com/browse/ZBX-25630
https://lists.debian.org/debian-lts-announce/2024/12/msg00005.html

Get alerted when CVE-2024-36464 or the next vulnerability affects your stack