CVE-2024-42327 Vulnerability Details

  /     /     /  

CVE-2024-42327 Metadata Quick Info

CVE Published: 27/11/2024 | CVE Updated: 04/12/2024 | CVE Year: 2024
Source: Zabbix | Vendor: Zabbix | Product: Zabbix
Status : PUBLISHED

---

CVE-2024-42327 Description

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

Metrics

CVSS Version: 3.1 | Base Score: 9.9 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* LOW
    User Interaction (UI)* NONE
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-89
CWE Name: CWE-89: SQL Injection
Source: Zabbix

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-233
CAPEC Description: CAPEC-233: Privilege Escalation


Source: NVD (National Vulnerability Database).