CVE-2022-23134lowunder attackCWE-284

CVE-2022-23134: low-severity vulnerability in Zabbix Frontend

Possible view of the setup pages by unauthenticated users if config file already exists

Published · Updated

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 3.7epss 95%
from disclosure to weapon1165 days
Published on NVDJan 13
1st PoC+1165d
CISA KEV+40d
exploitation probability
95%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2022-03-08

Apply updates per vendor instructions.

In short

After initial setup, unauthenticated users can access certain setup pages in Zabbix Frontend if the configuration file already exists. This allows attackers to potentially modify the system configuration without proper authentication.

Technical detail

CWE-284 improper access control vulnerability in setup.php allows unauthenticated users to bypass step validation and reach configuration-modifying endpoints post-installation. The attack vector is network-based with no authentication required; the precondition is an existing Zabbix configuration file. Impact is limited to unauthorized modification of frontend configuration settings.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Zabbix · Frontend
public PoCs found — 2
githubgithub.com/TheN00bBuilder/cve-2022-23134-poc-and-writeup★ 1vulncheckvulncheck.com/xdb/ed8b1935dc35unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Zabbix Frontend

In the same product, most dangerous first.

CVE-2022-23131CRITICALUnsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAMLEPSS 95.7%KEVCVE-2022-43515MEDIUMX-Forwarded-For header is active by default causes access to Zabbix sites in maintenance modeEPSS 1.3%CVE-2022-24919LOWReflected XSS in graph configuration window of Zabbix FrontendEPSS 1.2%CVE-2022-24917LOWReflected XSS in service configuration window of Zabbix FrontendEPSS 1.2%CVE-2022-24349MEDIUMReflected XSS in action configuration window of Zabbix FrontendEPSS 1.2%CVE-2022-24918LOWReflected XSS in item configuration window of Zabbix FrontendEPSS 1.2%
References
https://lists.debian.org/debian-lts-announce/2022/02/msg00008.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/https://support.zabbix.com/browse/ZBX-20384https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23134