CVE-2021-27927: zabbix Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2021-27927 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in zabbix. EPSS estimates a 2.20% chance of exploitation in the next 30 days, higher than 82.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 03-03-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.20%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.20% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- zabbix< 1:5.0.8+dfsg-1
Ubuntu1 product
- zabbixAll versions (No fix recorded)
Zabbix1 product
- zabbix≥ 4.0.0, ≤ 4.0.27 | ≥ 5.0.0, ≤ 5.0.9 | ≥ 5.2.0, ≤ 5.2.3
3 vendors · 3 products
