CSRF in Zabbix
CVE-2021-27927
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.015 (71.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Zabbix
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Patch, Issue Tracking, Vendor Advisory)
- cve@mitre.org (mailing-list)
Frequently asked questions
- What is CVE-2021-27927?
- CVE-2021-27927 is a high-severity vulnerability in Zabbix, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2021-03-03.
- How severe is CVE-2021-27927?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2021-27927 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.