CVE-2024-42327
Critical
Description
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
SeverityCritical
CVSS9.9
Exploit probability—
Product
Zabbix
PublishedNov 27, 2024
First seenNov 27, 2024
Weakness typeCWE-89SQL injection
How to fix
Update
- zabbix zabbix6.0.32, 6.4.17, 7.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zabbix zabbix | 6.0.0 ≤ v < 6.0.32, 6.4.0 ≤ v < 6.4.17, 7.0.0 ≤ v < 7.0.1 | 6.0.32, 6.4.17, 7.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.