CVE-2024-36465: SQL injection in Zabbix API
Published Apr 2, 2025
·Updated
A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.
Affected Software
4 affected components
Zabbix Zabbix API
Zabbix Zabbix>=7.0.0<=7.0.7
Zabbix Zabbix>=7.2.0<7.2.2
Zabbix Zabbix=7.0.8-rc1
Event History
Apr 2, 2025
CVE Published
via MITRE·06:11 AM
Data Sourced
via MITRE·06:11 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-36465?
CVE-2024-36465 has a low severity rating due to the requirement of low privileged API access.
2
How can I mitigate CVE-2024-36465?
To mitigate CVE-2024-36465, restrict API access to trusted users and ensure proper input validation on the groupBy parameter.
3
What type of vulnerability is identified in CVE-2024-36465?
CVE-2024-36465 is identified as an SQL injection vulnerability.
4
Who is affected by CVE-2024-36465?
Regular Zabbix users with API access are affected by CVE-2024-36465.
5
What impact can CVE-2024-36465 have on my system?
CVE-2024-36465 can potentially allow an attacker to execute arbitrary SQL commands, leading to unauthorized data access.