Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2021-27927 — HIGH severity vulnerability | Release Alert

CVE-2021-27927

8.8

HIGHCVSS v3

Published

March 3, 2021

CVSS v2

6.8 MEDIUM

Affected

6 projects

Assigned by

MITRE

Severity scale

010

Description

In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.

Python Package IndexPython module to work with zabbix.

>= 4.0.0, <= 4.0.27, >= 5.0.0, <= 5.0.9, >= 5.2.0, <= 5.2.3NVD

Crates.iozabbix

>= 4.0.0, <= 4.0.27, >= 5.0.0, <= 5.0.9, >= 5.2.0, <= 5.2.3NVD

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

Package Description

>= 4.0.0, <= 4.0.27, >= 5.0.0, <= 5.0.9, >= 5.2.0, <= 5.2.3NVD

NPMA minimal wrapper around request.js to facilitate fetching data from the Zabbix API.

>= 4.0.0, <= 4.0.27, >= 5.0.0, <= 5.0.9, >= 5.2.0, <= 5.2.3NVD

RubyGemssend data to zabbix from ruby

>= 4.0.0, <= 4.0.27, >= 5.0.0, <= 5.0.9, >= 5.2.0, <= 5.2.3NVD

GitHubReal-time monitoring of IT components and services, such as networks, servers, VMs, applications and the cloud.

>= 4.0.0, <= 4.0.27, >= 5.0.0, <= 5.0.9, >= 5.2.0, <= 5.2.3NVD