Read the docs
TI-2022-07303 Aliases CVE-2022-23134GHSA-mv97-qj5h-25f3

Possible view of the setup pages by unauthenticated users if config file already exists

Priority HIGH 81Exploited in the wildCWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

Why it matters now

Exploitation Active In CISA KEV since 2022-02-22CISA due date 2022-03-08
EPSS 0.9526 99th percentileScored 2026-11-07
Fix Fixed Frontend (Zabbix): 5.4.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZabbixFrontend5.4.0 - 5.4.85.4.9Patch availableCNA
  • Frontend VendorZabbix Affected 5.4.0 - 5.4.8 Fixed in 5.4.9 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*5.4.0 – 5.4.8VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:6.0.0:alpha1:*:*:*:*:*:*6.0.0 alpha1VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:6.0.0:alpha2:*:*:*:*:*:*6.0.0 alpha2VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:6.0.0:alpha3:*:*:*:*:*:*6.0.0 alpha3VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:6.0.0:alpha4:*:*:*:*:*:*6.0.0 alpha4VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:6.0.0:alpha5:*:*:*:*:*:*6.0.0 alpha5VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:6.0.0:alpha6:*:*:*:*:*:*6.0.0 alpha6VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:6.0.0:alpha7:*:*:*:*:*:*6.0.0 alpha7VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:6.0.0:beta1:*:*:*:*:*:*6.0.0 beta1VulnerableZabbix
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
  • cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* Versions 5.4.0 – 5.4.8 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:6.0.0:alpha1:*:*:*:*:*:* Versions 6.0.0 alpha1 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:6.0.0:alpha2:*:*:*:*:*:* Versions 6.0.0 alpha2 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:6.0.0:alpha3:*:*:*:*:*:* Versions 6.0.0 alpha3 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:6.0.0:alpha4:*:*:*:*:*:* Versions 6.0.0 alpha4 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:6.0.0:alpha5:*:*:*:*:*:* Versions 6.0.0 alpha5 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:6.0.0:alpha6:*:*:*:*:*:* Versions 6.0.0 alpha6 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:6.0.0:alpha7:*:*:*:*:*:* Versions 6.0.0 alpha7 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:6.0.0:beta1:*:*:*:*:*:* Versions 6.0.0 beta1 Vulnerable ·Zabbix
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · CNA Frontend (Zabbix) Fixed in 5.4.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Zabbix Frontend — FEDORA-2022-dfe346f53f

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2022-07302 Stored XSS in host groups configuration window in Zabbix FrontendPriority LOW 30
    Show all 2 records → Advisory →
  • Advisory ·

    Zabbix Frontend — FEDORA-2022-1a667b0f90

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2022-07302 Stored XSS in host groups configuration window in Zabbix FrontendPriority LOW 30
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2022-02-22 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2022-23134
  3. 2026-10-03 Alias added: GHSA-mv97-qj5h-25f3

References

Patch 1

Advisory 3

  • TI-2022-07300 Authentication bypass by spoofing in Zabbix Frontend KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-28315 SQL injection in user.get API CVSS 3.1CRITICAL 9.9
  • TI-2016-08210 SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote… CVSS 3.0CRITICAL 9.8
  • TI-2013-04884 Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7. CVSS 3.1CRITICAL 9.8
  • TI-2024-14721 Time Based SQL Injection in Zabbix Server Audit Log CVSS 3.1CRITICAL 9.1
  • TI-2022-21298 Zabbix Agent installer adds “allow all TCP any any” firewall rule CVSS 3.1CRITICAL 9.8
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences