vulnerability
FreeBSD: VID-f0d33375-b0e0-11ef-a724-b42e991fc52e (CVE-2024-42327): zabbix -- SQL injection in user.get API
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:S/C:C/I:C/A:C) | Dec 2, 2024 | Dec 3, 2024 | Dec 10, 2025 |
Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:C)
Published
Dec 2, 2024
Added
Dec 3, 2024
Modified
Dec 10, 2025
Description
[email protected] reports: A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
Solutions
freebsd-upgrade-package-zabbix6-frontendfreebsd-upgrade-package-zabbix64-frontendfreebsd-upgrade-package-zabbix7-frontend
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.