Read the docs
TI-2022-07300 Aliases CVE-2022-23131GHSA-4g73-3mxf-j47w

Authentication bypass by spoofing in Zabbix Frontend

Priority CRITICAL 100Exploited in the wildCWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-290.

Summary

In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).

Why it matters now

Exploitation Active In CISA KEV since 2022-02-22CISA due date 2022-03-08
EPSS 0.95683 99th percentileScored 2026-11-07
Fix Fixed Frontend (Zabbix): 5.4.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZabbixFrontend5.4.0 - 5.4.85.4.9Patch availableCNA
  • Frontend VendorZabbix Affected 5.4.0 - 5.4.8 Fixed in 5.4.9 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*5.4.0 – 5.4.8VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:6.0.0:alpha1:*:*:*:*:*:*6.0.0 alpha1VulnerableZabbix
  • cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* Versions 5.4.0 – 5.4.8 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:6.0.0:alpha1:*:*:*:*:*:* Versions 6.0.0 alpha1 Vulnerable ·Zabbix

Remediation

  • Fix · CNA Frontend (Zabbix) Fixed in 5.4.9

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2022-02-22 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2022-23131
  3. 2026-10-03 Alias added: GHSA-4g73-3mxf-j47w

References

Patch 1

  • TI-2024-28315 SQL injection in user.get API CVSS 3.1CRITICAL 9.9
  • TI-2016-08210 SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote… CVSS 3.0CRITICAL 9.8
  • TI-2013-04884 Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7. CVSS 3.1CRITICAL 9.8
  • TI-2022-07303 Possible view of the setup pages by unauthenticated users if config file already exists KEVCVSS 3.1MEDIUM 5.3
  • TI-2024-14721 Time Based SQL Injection in Zabbix Server Audit Log CVSS 3.1CRITICAL 9.1
  • TI-2022-21298 Zabbix Agent installer adds “allow all TCP any any” firewall rule CVSS 3.1CRITICAL 9.8
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences