<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">CVE-2024-36464</DocumentTitle>
  <DocumentType>SUSE CVE</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE CVE-2024-36464</ID>
    </Identification>
    <Status>Interim</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>7</Number>
        <Date>2025-11-01T02:11:02Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2024-11-28T00:34:15Z</InitialReleaseDate>
    <CurrentReleaseDate>2025-11-01T02:11:02Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf-cve.pl</Engine>
      <Date>2020-12-27T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="CVE" Type="Summary" Ordinal="1" xml:lang="en">CVE-2024-36464</Note>
    <Note Title="Mitre CVE Description" Type="Description" Ordinal="2" xml:lang="en">When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="4" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP4-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS" CPE="cpe:/o:suse:sles-ltss:12:sp4">SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP5-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP5-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5-LTSS" CPE="cpe:/o:suse:sles-ltss:12:sp5">SUSE Linux Enterprise Server 12 SP5-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security" CPE="cpe:/o:suse:sles-ltss-extended-security:12:sp5">SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server Teradata 12 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server Teradata 12 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Server Teradata 12 SP3" CPE="cpe:/o:suse:sles_teradata:12:sp3">SUSE Linux Enterprise Server Teradata 12 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server Teradata 12 SP3-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server Teradata 12 SP3-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server Teradata 12 SP3-LTSS" CPE="cpe:/o:suse:sles_ltss_teradata:12:sp3">SUSE Linux Enterprise Server Teradata 12 SP3-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="zabbix">
      <FullProductName ProductID="zabbix" CPE="cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*">zabbix</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="zabbix-agent">
      <FullProductName ProductID="zabbix-agent">zabbix-agent</FullProductName>
    </Branch>
    <Relationship ProductReference="zabbix-agent" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS:zabbix-agent">zabbix-agent as a component of SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS:zabbix">zabbix as a component of SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix-agent" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5-LTSS:zabbix-agent">zabbix-agent as a component of SUSE Linux Enterprise Server 12 SP5-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5-LTSS:zabbix">zabbix as a component of SUSE Linux Enterprise Server 12 SP5-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:zabbix">zabbix as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server Teradata 12 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Server Teradata 12 SP3:zabbix">zabbix as a component of SUSE Linux Enterprise Server Teradata 12 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="zabbix" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server Teradata 12 SP3-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server Teradata 12 SP3-LTSS:zabbix">zabbix as a component of SUSE Linux Enterprise Server Teradata 12 SP3-LTSS</FullProductName>
    </Relationship>
  </ProductTree>
  <Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords.</Note>
    </Notes>
    <CVE>CVE-2024-36464</CVE>
    <ProductStatuses>
      <Status Type="Known Not Affected">
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:zabbix</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:zabbix-agent</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:zabbix</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5-LTSS:zabbix</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5-LTSS:zabbix-agent</ProductID>
        <ProductID>SUSE Linux Enterprise Server Teradata 12 SP3-LTSS:zabbix</ProductID>
        <ProductID>SUSE Linux Enterprise Server Teradata 12 SP3:zabbix</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>2.7</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
  </Vulnerability>
</cvrfdoc>
