CVE-2024-42327

critical · 9.9

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

9.9

CVSS

78.7%

EPSS (exploit prob.)

100th

EPSS percentile

2024-11-27

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
zabbix	zabbix	>= 6.0.0, < 6.0.32
zabbix	zabbix	>= 6.4.0, < 6.4.17
zabbix	zabbix	>= 7.0.0, < 7.0.1

Check a specific version with /api/v1/cve/match.

References

https://support.zabbix.com/browse/ZBX-25623

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-42327