Lucene search

[email protected]CVE-2022-23134

HistoryJan 13, 2022 - 4:15 p.m.

CVE-2022-23134

2022-01-1316:15:08

CWE-287

CWE-284

[email protected]

web.nvd.nist.gov

894

In Wild

cve

configuration

zabbix

frontend

security

vulnerability

authentication

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

6.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.63 Medium

EPSS

Percentile

97.9%

JSON

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

Affected configurations

NVD

Node

zabbixzabbixRange5.4.0–5.4.8

zabbixzabbixMatch6.0.0alpha1

zabbixzabbixMatch6.0.0alpha2

zabbixzabbixMatch6.0.0alpha3

zabbixzabbixMatch6.0.0alpha4

zabbixzabbixMatch6.0.0alpha5

zabbixzabbixMatch6.0.0alpha6

zabbixzabbixMatch6.0.0alpha7

zabbixzabbixMatch6.0.0beta1

Node

fedoraprojectfedoraMatch34

fedoraprojectfedoraMatch35

Node

debiandebian_linuxMatch9.0

CPENameOperatorVersion
zabbix:zabbixzabbixle5.4.8
zabbix:zabbixzabbixeq6.0.0

CPE	Name	Operator	Version
zabbix:zabbix	zabbix	le	5.4.8
zabbix:zabbix	zabbix	eq	6.0.0

CNA Affected

[
  {
    "product": "Frontend",
    "vendor": "Zabbix",
    "versions": [
      {
        "status": "affected",
        "version": "5.4.0 - 5.4.8"
      },
      {
        "lessThan": "5.4.9*",
        "status": "unaffected",
        "version": "5.4.9",
        "versionType": "custom"
      }
    ]
  }
]