CVE-2021-27927
In Zabbix before 4.0.28rc1, 5.x before 5.0.8rc1, 5.1.x and 5.2.x before 5.2.4rc1, and 5.3.x and 5...
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
- Record
CVE-2021-27927- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
- Record
CVE-2021-27927- Updated
- 2026-11-02
EUVDEUVD-2021-14647 No score
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
- Record
EUVD-2021-14647- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3mh6-r7m6-r42x
In Zabbix before 4.0.28rc1, 5.x before 5.0.8rc1, 5.1.x and 5.2.x before 5.2.4rc1, and 5.3.x and 5...
In Zabbix before 4.0.28rc1, 5.x before 5.0.8rc1, 5.1.x and 5.2.x before 5.2.4rc1, and 5.3.x and 5.4.x before 5.4.0alpha1, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method.
- Record
GHSA-3mh6-r7m6-r42x- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-27927
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
- Record
ALPINE-CVE-2021-27927- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
- Record
CVE-2021-27927- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2021-27927
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
- Record
DEBIAN-CVE-2021-27927- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-27927
In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
- Record
UBUNTU-CVE-2021-27927- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0036-1 No score
Security update for zabbix
This update for zabbix fixes the following issues:
- Updated to latest realease 4.0.37.
Security issues fixed:
- CVE-2022-23134: Fixed possible view of the setup pages by unauthenticated users if config file already exists (boo#1194681).
- CVE-2021-27927: Fixed CSRF protection mechanism inside CControllerAuthenticationUpdate controller (boo#1183014).
- CVE-2020-15803: Fixed stored XSS in the URL Widget (boo#1174253).
Bugfixes:
- boo#1181400: Added hardening to systemd service(s)
- boo#1144018: Restructured for easier maintenance because FATE#324346
- Record
openSUSE-SU-2022:0036-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11539-1 No score
zabbix-agent-4.0.32-1.4 on GA media
These are all security issues fixed in the zabbix-agent-4.0.32-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11539-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:0990-1 No score
Security update for zabbix
This update for zabbix fixes the following issues:
- CVE-2021-27927: Fixed an improper CSRF protection mechanism (bsc#1183014).
- CVE-2013-7484: Fixed an issue where passwords in the users table were unsalted (bsc#1158321).
- Record
SUSE-SU-2021:0990-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zabbixAlpine:v3.12 |
4.0.0 up to 5.0.9-r0 | 5.0.9-r0 |
zabbixAlpine:v3.13 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixAlpine:v3.14 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixAlpine:v3.15 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixAlpine:v3.16 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixAlpine:v3.17 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixAlpine:v3.18 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixAlpine:v3.19 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixAlpine:v3.20 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixAlpine:v3.21 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
zabbixAlpine:v3.22 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixAlpine:v3.23 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixAlpine:v3.24 |
4.0.0 up to 5.2.6-r0 | 5.2.6-r0 |
zabbixDebian:12 |
before 1:5.0.8+dfsg-1 | 1:5.0.8+dfsg-1 |
zabbixDebian:13 |
before 1:5.0.8+dfsg-1 | 1:5.0.8+dfsg-1 |
zabbixDebian:14 |
before 1:5.0.8+dfsg-1 | 1:5.0.8+dfsg-1 |
zabbixDebian:10 From an advisory covering 8 CVEs |
before 1:4.0.4+dfsg-1+deb10u1, plus listed versions 1:4.0.4+dfsg-1 |
1:4.0.4+dfsg-1+deb10u1 |
zabbixSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 4.0.12-4.12.1 | 4.0.12-4.12.1 |
zabbixSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 4.0.12-4.12.1 | 4.0.12-4.12.1 |
zabbixUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:4.0.4+dfsg-1build21:4.0.4+dfsg-1build31:4.0.11+dfsg-11:4.0.14+dfsg-11:4.0.15+dfsg-1 Show 5 moreShow less1:4.0.16+dfsg-11:4.0.16+dfsg-1build11:4.0.17+dfsg-11:4.0.17+dfsg-1ubuntu0.1~esm11:4.0.17+dfsg-1ubuntu0.1~esm2 |
None known |
zabbixopenSUSE:Leap 15.3 From an advisory covering 3 CVEs |
before 4.0.37-lp153.2.3.1 | 4.0.37-lp153.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-27927 is a high vulnerability (CVSS 8.8) in Zabbix, published March 3, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.20%, the 82nd percentile. Fixed in zabbix 5.0.9-r0.
References
support.zabbix.com/browse/ZBX-18942
lists.debian.org/debian-lts-announce/2023/04/msg00013.html
nvd.nist.gov/vuln/detail/CVE-2021-27927
github.com/advisories/GHSA-3mh6-r7m6-r42x
security.alpinelinux.org/vuln/CVE-2021-27927
security-tracker.debian.org/tracker/CVE-2021-27927
Show 14 moreShow less
suse.com/support/update/announcement/2021/suse-su-20210990-1
bugzilla.suse.com/1158321
ubuntu.com/security/CVE-2021-27927
cve.org/CVERecord?id=CVE-2021-27927
lists.opensuse.org/archives/list/[email protected]/thread/EDFZEEJCPRPPDEWV6JULRJZVSQCMYOEY