Vulnerability details
CVE-2024-42327
Zabbix Zabbix
SQL injection in user.get API
CVSS 3.1
9.9Critical
Official description
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.9Critical | 3.1 | CVEProject cvelistV5 (CNA) (Zabbix) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Zabbix | Zabbix | 6.0.0 ≤ v ≤ 6.0.31 | CVEProject cvelistV5 (CNA) |
| Zabbix | Zabbix | 6.0.0 ≤ v ≤ 6.0.31 | CISA ADP / Vulnrichment |
| Zabbix | Zabbix | 6.4.0 ≤ v ≤ 6.4.16 | CVEProject cvelistV5 (CNA) |
| Zabbix | Zabbix | 6.4.0 ≤ v ≤ 6.4.16 | CISA ADP / Vulnrichment |
| Zabbix | Zabbix | 7.0.0 ≤ v ≤ 7.0.1 | CVEProject cvelistV5 (CNA) |
| Zabbix | Zabbix | 7.0.0 ≤ v ≤ 7.0.1 | CISA ADP / Vulnrichment |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2024-11-27
- Last updated
- 2024-12-04
- State
- Published
- Assigner (CNA)
- Zabbix
- Kolun priority
- 50 · Medium
Exploit prediction (EPSS)
79.1%
Probability of exploitation in 30 days
99.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-89SQL Injection