{"id":"CVE-2021-27927","aliases":["ALPINE-CVE-2021-27927","DEBIAN-CVE-2021-27927","DLA-3390-1","EUVD-2021-14647","GHSA-3mh6-r7m6-r42x","SUSE-SU-2021:0990-1","UBUNTU-CVE-2021-27927","openSUSE-SU-2022:0036-1","openSUSE-SU-2024:11539-1"],"status":"published","title":"In Zabbix before 4.0.28rc1, 5.x before 5.0.8rc1, 5.1.x and 5.2.x before 5.2.4rc1, and 5.3.x and 5...","description":"In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02196,"percentile":0.82746,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2021-03-03T00:00:00Z","modified":"2026-11-03T06:32:27Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"zabbix","fixed_in":["5.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"zabbix","fixed_in":["5.2.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"zabbix","fixed_in":["1:5.0.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zabbix","fixed_in":["1:5.0.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zabbix","fixed_in":["1:5.0.8+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.2.6-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.4+dfsg-1+deb10u1"}]}],"versions":["1:4.0.4+dfsg-1"],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-4.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-4.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.0.4+dfsg-1build2","1:4.0.4+dfsg-1build3","1:4.0.11+dfsg-1","1:4.0.14+dfsg-1","1:4.0.15+dfsg-1","1:4.0.16+dfsg-1","1:4.0.16+dfsg-1build1","1:4.0.17+dfsg-1","1:4.0.17+dfsg-1ubuntu0.1~esm1","1:4.0.17+dfsg-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.37-lp153.2.3.1"}]}],"bundled":3}],"products":[{"vendor":"zabbix","product":"zabbix"}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-18942","tags":["x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27927"},{"url":"https://github.com/advisories/GHSA-3mh6-r7m6-r42x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-27927","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-27927","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210990-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1158321","tags":["report"]},{"url":"https://bugzilla.suse.com/1183014","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27927","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-27927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27927","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EDFZEEJCPRPPDEWV6JULRJZVSQCMYOEY/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1144018","tags":["report"]},{"url":"https://bugzilla.suse.com/1174253","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1194681","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23134","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-27927","description":"In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.","status":"published","published":"2021-03-03T00:00:00Z","modified":"2024-08-03T21:33:16.68Z","updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-14647","description":"In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.","status":"published","published":"2021-03-03T00:00:00Z","modified":"2024-08-03T21:33:16Z","updated_at":"2026-11-03T03:24:48.366655Z"}],"ghsa":[{"id":"GHSA-3mh6-r7m6-r42x","title":"In Zabbix before 4.0.28rc1, 5.x before 5.0.8rc1, 5.1.x and 5.2.x before 5.2.4rc1, and 5.3.x and 5...","description":"In Zabbix before 4.0.28rc1, 5.x before 5.0.8rc1, 5.1.x and 5.2.x before 5.2.4rc1, and 5.3.x and 5.4.x before 5.4.0alpha1, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method.","status":"published","published":"2022-05-24T17:43:36Z","modified":"2023-04-20T05:08:35Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:54:32.269335Z"}],"nvd":[{"id":"CVE-2021-27927","description":"In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.","status":"published","published":"2021-03-03T17:15:12.753Z","modified":"2026-06-17T03:45:37.82Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:06:50.399901Z"}],"osv":[{"id":"ALPINE-CVE-2021-27927","description":"In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.","status":"published","published":"2021-03-03T17:15:12.753Z","modified":"2026-11-03T06:32:27.740173961Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2021-27927","description":"In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.","status":"published","published":"2021-03-03T17:15:12.753Z","modified":"2026-03-14T10:53:05.974586Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-27927","description":"In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.","status":"published","published":"2021-03-03T17:15:12.753Z","modified":"2026-10-23T18:02:57.637441217Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"UBUNTU-CVE-2021-27927","description":"In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.","status":"published","published":"2021-03-03T17:15:00Z","modified":"2025-09-08T16:47:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-3390-1","title":"zabbix - security update","status":"published","published":"2023-04-12T00:00:00Z","modified":"2026-03-09T01:18:24.778318Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"openSUSE-SU-2022:0036-1","title":"Security update for zabbix","description":"This update for zabbix fixes the following issues:\n\n- Updated to latest realease 4.0.37.\n\nSecurity issues fixed:\n\n- CVE-2022-23134: Fixed possible view of the setup pages by unauthenticated users if config file already exists (boo#1194681).\n- CVE-2021-27927: Fixed CSRF protection mechanism inside CControllerAuthenticationUpdate controller (boo#1183014).\n- CVE-2020-15803: Fixed stored XSS in the URL Widget (boo#1174253).\n\nBugfixes:\n\n- boo#1181400: Added hardening to systemd service(s)\n- boo#1144018: Restructured for easier maintenance because FATE#324346\n","status":"published","published":"2022-02-16T09:04:51Z","modified":"2026-02-04T03:06:53.907755Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11539-1","title":"zabbix-agent-4.0.32-1.4 on GA media","description":"These are all security issues fixed in the zabbix-agent-4.0.32-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:40:56.860815Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:0990-1","title":"Security update for zabbix","description":"This update for zabbix fixes the following issues:\n\t  \n- CVE-2021-27927: Fixed an improper CSRF protection mechanism (bsc#1183014).\n- CVE-2013-7484: Fixed an issue where passwords in the users table were unsalted (bsc#1158321).\n","status":"published","published":"2021-03-30T15:59:13Z","modified":"2026-02-04T04:40:39.382283Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}