CVE-2025-27240 - Vulnerability Details - OpenCVE

A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Fixes

Solution

Update the affected components to their respective fixed versions.

Workaround

Disable any Autoregistration actions that remove hosts.

References

Link	Providers
https://support.zabbix.com/browse/ZBX-26986

History

Fri, 12 Sep 2025 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 12 Sep 2025 10:45:00 +0000

Type	Values Removed	Values Added
Description		A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.
Title		Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host
Weaknesses		CWE-89
References		https://support.zabbix.com/browse/ZBX-26986
Metrics		cvssV4_0 `{'score': 7.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Zabbix

Published: 2025-09-12T10:33:46.484Z

Updated: 2025-09-12T11:53:44.446Z

Reserved: 2025-02-20T11:40:38.480Z

Link: CVE-2025-27240

Vulnrichment

Updated: 2025-09-12T11:53:38.647Z

NVD

Status : Received

Published: 2025-09-12T11:15:31.633

Modified: 2025-09-12T11:15:31.633

Link: CVE-2025-27240

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27240", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "state": "PUBLISHED", "assignerShortName": "Zabbix", "dateReserved": "2025-02-20T11:40:38.480Z", "datePublished": "2025-09-12T10:33:46.484Z", "dateUpdated": "2025-09-12T11:53:44.446Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["Server"], "product": "Zabbix", "repo": "https://git.zabbix.com/", "vendor": "Zabbix", "versions": [{"changes": [{"at": "6.0.34", "status": "unaffected"}], "lessThanOrEqual": "6.0.33", "status": "affected", "version": "6.0.0", "versionType": "git"}, {"changes": [{"at": "6.0.19", "status": "unaffected"}], "lessThanOrEqual": "6.4.18", "status": "affected", "version": "6.4.0", "versionType": "git"}, {"changes": [{"at": "7.0.4", "status": "unaffected"}], "lessThanOrEqual": "7.0.3", "status": "affected", "version": "7.0.0", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The attacker needs to be a Zabbix administrator and also needs access to a host that is later auto-removed.</p>"}], "value": "The attacker needs to be a Zabbix administrator and also needs access to a host that is later auto-removed."}], "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank Grzegorz Muszy\u0144ski (szerszen199) for submitting this report on the HackerOne bug bounty platform."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.</p>"}], "value": "A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66: SQL Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.5, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2025-09-12T10:33:46.484Z"}, "references": [{"url": "https://support.zabbix.com/browse/ZBX-26986"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update the affected components to their respective fixed versions.</p>"}], "value": "Update the affected components to their respective fixed versions."}], "source": {"discovery": "EXTERNAL"}, "title": "Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Disable any Autoregistration actions that remove hosts.</p>"}], "value": "Disable any Autoregistration actions that remove hosts."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-12T11:53:31.639516Z", "id": "CVE-2025-27240", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T11:53:44.446Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27240", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-12T11:53:31.639516Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T11:53:38.647Z"}}], "cna": {"title": "Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank Grzegorz Muszy\u0144ski (szerszen199) for submitting this report on the HackerOne bug bounty platform."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66: SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.zabbix.com/", "vendor": "Zabbix", "modules": ["Server"], "product": "Zabbix", "versions": [{"status": "affected", "changes": [{"at": "6.0.34", "status": "unaffected"}], "version": "6.0.0", "versionType": "git", "lessThanOrEqual": "6.0.33"}, {"status": "affected", "changes": [{"at": "6.0.19", "status": "unaffected"}], "version": "6.4.0", "versionType": "git", "lessThanOrEqual": "6.4.18"}, {"status": "affected", "changes": [{"at": "7.0.4", "status": "unaffected"}], "version": "7.0.0", "versionType": "git", "lessThanOrEqual": "7.0.3"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Update the affected components to their respective fixed versions.", "supportingMedia": [{"type": "text/html", "value": "<p>Update the affected components to their respective fixed versions.</p>", "base64": false}]}], "references": [{"url": "https://support.zabbix.com/browse/ZBX-26986"}], "workarounds": [{"lang": "en", "value": "Disable any Autoregistration actions that remove hosts.", "supportingMedia": [{"type": "text/html", "value": "<p>Disable any Autoregistration actions that remove hosts.</p>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.", "supportingMedia": [{"type": "text/html", "value": "<p>A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "configurations": [{"lang": "en", "value": "The attacker needs to be a Zabbix administrator and also needs access to a host that is later auto-removed.", "supportingMedia": [{"type": "text/html", "value": "<p>The attacker needs to be a Zabbix administrator and also needs access to a host that is later auto-removed.</p>", "base64": false}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2025-09-12T10:33:46.484Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27240", "state": "PUBLISHED", "dateUpdated": "2025-09-12T11:53:44.446Z", "dateReserved": "2025-02-20T11:40:38.480Z", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "datePublished": "2025-09-12T10:33:46.484Z", "assignerShortName": "Zabbix"}, "dataVersion": "5.1"}