CVE-2024-45699: Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-02 · updated 2026-06-17
Weakness: CWE-79

Description

The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.

Affected products

Zabbix: from 6.0.0 before 6.0.37; from 6.4.0 before 6.4.21; from 7.0.0 before 7.0.7 — fixed in 6.0.37, 6.4.21, 7.0.7

How to fix

Upgrade to a fixed version: Zabbix 6.0.37, 6.4.21, 7.0.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-45699 or the next vulnerability affects your stack