Lucene search
Debian Security Bug TrackerDEBIANCVE:CVE-2022-23131HistoryJan 13, 2022 - 4:15 p.m.
CVE-2022-23131
2022-01-1316:15:00
Debian Security Bug Tracker
security-tracker.debian.org
11
0.972 High
EPSS
Percentile
99.8%
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | zabbix | < 1:6.0.14+dfsg-1 | zabbix_1:6.0.14+dfsg-1_all.deb |
| Debian | 11 | all | zabbix | < 1:5.0.8+dfsg-1 | zabbix_1:5.0.8+dfsg-1_all.deb |
| Debian | 10 | all | zabbix | < 1:4.0.4+dfsg-1 | zabbix_1:4.0.4+dfsg-1_all.deb |
| Debian | 999 | all | zabbix | < 1:6.0.29+dfsg-1 | zabbix_1:6.0.29+dfsg-1_all.deb |
Related
alpinelinux
alpinelinux
CVE-2022-23131
2022-01-13 16:15:00
ubuntucve
ubuntucve
CVE-2022-23131
2022-01-13 00:00:00
githubexploit
githubexploit
Exploit for Authentication Bypass by Spoofing in Zabbix
2023-10-24 08:11:06
Exploit for Authentication Bypass by Spoofing in Zabbix
2022-02-21 02:42:23
Exploit for Authentication Bypass by Spoofing in Zabbix
2022-02-24 08:10:46
osv
osv
CVE-2022-23131
2022-01-13 16:15:08
cisa_kev
cisa_kev
Zabbix Frontend Authentication Bypass Vulnerability
2022-02-22 00:00:00
cnvd
cnvd
Zabbix Sia Zabbix has an unspecified vulnerability
2022-01-17 00:00:00
nuclei
nuclei
Zabbix - SAML SSO Authentication Bypass
2022-02-20 12:37:19
attackerkb
attackerkb
CVE-2022-23131
2021-11-22 00:00:00
checkpoint_advisories
checkpoint_advisories
Zabbix Web Frontend Authentication Bypass (CVE-2022-23131)
2022-03-02 00:00:00
cvelist
cvelist
prion
prion
Default credentials
2022-01-13 16:15:00
cve
cve
CVE-2022-23131
2022-01-13 16:15:00
cisa
cisa
CISA Adds Two Known Exploited Vulnerabilities to Catalog
2022-02-22 00:00:00
thn
thn
hivepro
hivepro
Zabbix affected by two actively exploited vulnerabilities
2022-02-24 10:27:48
sonarsource
sonarsource
Zabbix - A Case Study of Unsafe Session Storage
2022-02-16 00:00:00
nessus
nessus
Zabbix 5.4.x < 5.4.9 Multiple Vulnerabilities
2022-02-28 00:00:00