CVE-2024-36465

The record

A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.

Affected packages

Related vulnerabilities

• CVE-2024-36464 When exporting media types, the password is exported in the YAML in plain text. Also affects zabbix
• CVE-2024-42330 The HttpRequest object allows to get the HTTP headers from the server's response after… Also affects zabbix
• CVE-2024-42333 The researcher is showing that it is possible to leak a small amount of Zabbix Server… Also affects zabbix
• CVE-2024-42332 The researcher is showing that due to the way the SNMP trap log is parsed, an attacker… Also affects zabbix
• CVE-2024-42331 In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap… Also affects zabbix
• CVE-2024-36467 An authenticated user with API access (e.g.: user with default User role), more… Also affects zabbix
• CVE-2024-22117 When a URL is added to the map element, it is recorded in the database with sequential… Also affects zabbix
• CVE-2024-36463 The implementation of atob in "Zabbix JS" allows to create a string with arbitrary… Also affects zabbix