vulnerability
FreeBSD: VID-f0d33375-b0e0-11ef-a724-b42e991fc52e (CVE-2024-42327): zabbix -- SQL injection in user.get API
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:S/C:C/I:C/A:C) | Dec 2, 2024 | Dec 3, 2024 | Mar 25, 2026 |
Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:C)
Published
Dec 2, 2024
Added
Dec 3, 2024
Modified
Mar 25, 2026
Description
[email protected] reports: A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
Solutions
freebsd-upgrade-package-zabbix6-frontendfreebsd-upgrade-package-zabbix64-frontendfreebsd-upgrade-package-zabbix7-frontend
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.