TI-2022-08726 Aliases CVE-2022-24919 GHSA-cf7c-p4p5-gq5x

Reflected XSS in graph configuration window of Zabbix Frontend

LOW 23CWE-79Published 2022-03-09 · Updated 2025-11-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.

Why it matters now

EPSS 0.01222 68th percentileScored 2026-11-07

Fix Fixed Frontend (Zabbix): 4.0.39rc1, 5.0.21rc1, 5.4.11rc1 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zabbix	Frontend	4.0.0-4.0.38; 5.0.0-5.0.20; 5.4.0-5.4.10; 6.0	4.0.39rc1, 5.0.21rc1, 5.4.11rc1, 6.0.1rc1	Patch available	CNA

Frontend VendorZabbix Affected 4.0.0-4.0.38; 5.0.0-5.0.20; 5.4.0-5.4.10; 6.0 Fixed in 4.0.39rc1, 5.0.21rc1, 5.4.11rc1, 6.0.1rc1 Patch available CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:a:zabbix:frontend::::::::	4.0.0 – 4.0.38; 5.0.0 – 5.0.20; 5.4.0 – 5.4.10	Vulnerable	Zabbix
cpe:2.3:a:zabbix:frontend:6.0.0:::::::*	6.0.0	Vulnerable	Zabbix
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian
cpe:2.3:o:fedoraproject:fedora:34:::::::*	34	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:35:::::::*	35	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:36:::::::*	36	Vulnerable	Fedoraproject

cpe:2.3:a:zabbix:frontend:*:*:*:*:*:*:*:* Versions 4.0.0 – 4.0.38; 5.0.0 – 5.0.20; 5.4.0 – 5.4.10 Vulnerable ·Zabbix
cpe:2.3:a:zabbix:frontend:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Zabbix
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

Fix · CNA Frontend (Zabbix) Fixed in 4.0.39rc1, 5.0.21rc1, 5.4.11rc1, 6.0.1rc1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2022-03-09
Zabbix Frontend — FEDORA-2022-5fab125c08
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2022-08227 Reflected XSS in action configuration window of Zabbix FrontendPriority LOW 24
- TI-2022-08725 Reflected XSS in item configuration window of Zabbix FrontendPriority LOW 23
- TI-2022-08724 Reflected XSS in service configuration window of Zabbix FrontendPriority LOW 23
Show all 4 records → Advisory →
Advisory · 2022-03-09
Zabbix Frontend — FEDORA-2022-19a9053f17
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2022-08227 Reflected XSS in action configuration window of Zabbix FrontendPriority LOW 24
- TI-2022-08725 Reflected XSS in item configuration window of Zabbix FrontendPriority LOW 23
- TI-2022-08724 Reflected XSS in service configuration window of Zabbix FrontendPriority LOW 23
Show all 4 records → Advisory →

Show 1 more group

Advisory · 2022-03-09
Zabbix Frontend — FEDORA-2022-d714c0d39c
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2022-08227 Reflected XSS in action configuration window of Zabbix FrontendPriority LOW 24
- TI-2022-08725 Reflected XSS in item configuration window of Zabbix FrontendPriority LOW 23
- TI-2022-08724 Reflected XSS in service configuration window of Zabbix FrontendPriority LOW 23
Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-24919
2026-10-03 Alias added: GHSA-cf7c-p4p5-gq5x

References

Patch 1

https://support.zabbix.com/browse/ZBX-20680

Advisory 4

Other 1

[debian-lts-announce] 20230412 [SECURITY] [DLA 3390-1] zabbix security update

TI-2022-21297 X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode CVSS 3.1CRITICAL 9.8
TI-2023-15994 Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget. CVSS 3.1CRITICAL 9.6
TI-2025-20084 Frontend arbitrary file read in oauth.authorize action CVSS 4.0MEDIUM 6.8
TI-2023-13836 Insufficient validation of Action form input fields CVSS 3.1MEDIUM 6.3
TI-2023-13834 Reflected XSS in several fields of graph form CVSS 3.1MEDIUM 6.1
TI-2025-31622 Frontend DoS vulnerability due to asymmetric resource consumption CVSS 4.0MEDIUM 6.0

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences