Description
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
INFO
Published Date :
2024-11-27T12:04:31.950Z
Last Modified :
2024-12-04T04:55:21.730Z
Source :
Zabbix
AFFECTED PRODUCTS
The following products are affected by CVE-2024-42327 vulnerability.
| Vendors | Products |
|---|---|
| Zabbix |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2024-42327.
| URL | Resource |
|---|---|
| https://support.zabbix.com/browse/ZBX-25623 |
|
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact