Database/Control plane, storage & DevOps
Zabbix: SQL injection in CUser::addRelatedObjects reachable by ANY non-admin account with API access
CVSS 9.9CVE-2024-42327Control plane, storage & DevOpscurated
Impact
SQL injection in CUser::addRelatedObjects reachable by ANY non-admin account with API access -> full DB compromise
Who can reach it
Network (remote)
What to do
Control-plane: URGENT upgrade; Zabbix commonly stores datacenter/IPMI credentials
References
Related entries
- Zabbix: Unverified user login in session data (SAML SSO enabled)CVE-2022-23131 · ZabbixCritical
- Zabbix: Unsanitized clientip in the audit logCVE-2024-22120 · ZabbixCritical
- Zabbix: Some setup.php steps reachable by unauthenticated usersCVE-2022-23134 · ZabbixLow
- Grafana: SQL Expressions passes user input to duckdb unsanitizedCVE-2024-9264 · GrafanaCritical
- Redis: "RediShell" - authenticated user crafts a Lua script to trigger a use-after-freeCVE-2025-49844 · RedisCritical
- Logging operator: unescaped Flow CRD values inject Fluentd directives and run commands in the aggregatorCVE-2026-54680 · Logging operator (Fluentd config renderer, pkg/sdk/logging/model/render/fluent.go)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.