Critical
Security advisory
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-42327
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:26 UTC · Revision 1
Source evidence
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
osv:CVE-2024-42327
Complete source record
{
"id": "9b606f653654ab1e6d2c46f62b7d21214d9955b3a772a983f66980b641cf7608",
"url": "https://osv.dev/vulnerability/CVE-2024-42327",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2024-42327",
"summary": "A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.",
"evidence": "osv:CVE-2024-42327",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2024-42327",
"aliases": [
"CVE-2024-42327"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/zabbix/zabbix",
"type": "GIT",
"events": [
{
"introduced": "5203d2ea7d901cd33d148f20586e2155901a7faa"
},
{
"fixed": "e0ebc610bbe07feec683b36b33b0c7c54d4dfa51"
},
{
"introduced": "49955f1fb5c9168a8a24b053f7ade6b3d903143c"
},
{
"fixed": "0543fbe4af6b9833aba9005540c1544272499225"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.32"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"7.0.1rc2",
"7.0.1rc1",
"6.0.32rc1",
"6.0.31",
"6.0.31rc1",
"7.0.0",
"6.0.30",
"6.0.30rc1",
"6.0.29",
"6.0.29rc1",
"6.0.28",
"6.0.28rc1",
"6.0.27rc1",
"6.0.27",
"6.0.26",
"6.0.26rc1",
"6.0.25",
"6.0.25rc1",
"6.0.23",
"6.0.23rc1",
"6.0.22",
"6.0.22rc1",
"6.0.21",
"6.0.21rc1",
"6.0.20",
"6.0.20rc1",
"6.0.19",
"6.0.19rc1",
"6.0.18rc1",
"6.0.18",
"6.0.17",
"6.0.17rc2",
"6.0.17rc1",
"6.0.16",
"6.0.16rc1",
"6.0.15",
"6.0.15rc2",
"6.0.15rc1",
"6.0.14",
"6.0.14rc2",
"6.0.14rc1",
"6.0.13",
"6.0.13rc1",
"6.0.12",
"6.0.12rc2",
"6.0.12rc1",
"6.0.11",
"6.0.11rc2",
"6.0.11rc1",
"6.0.10rc1",
"6.0.10",
"6.0.10rc2",
"6.0.9",
"6.0.9rc2",
"6.0.9rc1",
"6.0.8",
"6.0.8rc2",
"6.0.8rc1",
"6.0.7",
"6.0.1",
"6.0.7rc1",
"6.0.6",
"6.0.6rc1",
"6.0.5",
"6.0.5rc1",
"6.0.4",
"6.0.4rc1",
"6.0.3",
"6.0.3rc1",
"6.0.2",
"6.0.2rc1",
"6.0.1rc4",
"6.0.1rc3",
"6.0.1rc2",
"6.0.1rc1",
"6.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42327.json",
"vanir_signatures": [
{
"id": "CVE-2024-42327-304bfe13",
"digest": {
"threshold": 0.9,
"line_hashes": [
"268532432675997961382533109683550991275",
"77468328968705158713064176216215297941",
"242617437909076284338012963993674069245",
"53988357087650554977707365843443920215",
"128232534528403919384584568266563623737",
"8192478687897789813459981120771879298"
]
},
"source": "https://github.com/zabbix/zabbix/commit/e0ebc610bbe07feec683b36b33b0c7c54d4dfa51",
"target": {
"file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2024-42327-e2a91b12",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43636950122256154266010777110842379173",
"150345703210521586960191098792874252545",
"145617903543086714152812391346310142386",
"187012436310723479239082560666125826862",
"149341614607942162121466632515421063223",
"216393015426645457264218364948720538146"
]
},
"source": "https://github.com/zabbix/zabbix/commit/0543fbe4af6b9833aba9005540c1544272499225",
"target": {
"file": "src/zabbix_java/src/com/zabbix/gateway/GeneralInformation.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:23:38Z"
}
}
],
"modified": "2026-10-24T14:23:38.226153170Z",
"provider": "osv",
"references": [
"https://support.zabbix.com/browse/ZBX-25623"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*"
],
"vendor_product": "zabbix:zabbix",
"extracted_events": [
{
"range": [
{
"introduced": "6.4.0"
},
{
"fixed": "6.4.17"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2024-42327",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443695,
"published_at": "2024-11-27T12:15:20.64+00:00"
}