Vulnerability Database

317,182

Total vulnerabilities in the database

CVE-2024-42327

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

  • Published: Nov 27, 2024
  • Updated: Nov 16, 2025
  • CVE: CVE-2024-42327
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.9
  • AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWEs:

OWASP TOP 10:

Software From Fixed in
zabbix / zabbix 6.0.0 6.0.32
zabbix / zabbix 6.4.0 6.4.17
zabbix / zabbix 7.0.0 7.0.1