CVE-2024-42327

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-423285.5When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_w CVE-2024-423293.3The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this fun CVE-2024-42334.3Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, T CVE-2024-423309.1The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned CVE-2024-423313.3In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap p CVE-2024-423323.7The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of infor CVE-2024-423332.7The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedi CVE-2024-423355.47Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-423369.8Servision - CWE-287: Improper Authentication CVE-2024-423376.5CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-423384.3CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-423394.3CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor