CVE-2024-36465

High CVSS: 8.6

A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.

Vendor

Zabbix

Product

Zabbix

CWE

CWE-89

Yayın Tarihi

2025-04-02 06:15:34

Güncelleme

2025-10-08 15:31:44

Source Identifier

security@zabbix.com

KEV Date Added

Kategoriler

CWE-89 Zabbix HIGH Zabbix 2025

Referanslar

https://support.zabbix.com/browse/ZBX-26257

Benzer Kayıtlar

Medium

CVE-2025-49643

An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending sp…

Medium

CVE-2025-27232

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver le…

Medium

CVE-2025-49641

A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refre…

Medium

CVE-2025-27231

The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host…

Low

CVE-2025-27236

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have…

Low

CVE-2025-27238

Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user gr…