Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 9.1epss 96%
de la publicación al arma36 días
Publicada en NVD13 ene
1ª PoC+36d
CISA KEV+40d
probabilidad de explotación
96%top 1% de las CVE
explotación observada
síCISA + VulnCheck
38 exploit(s) público(s)
Acción exigida por CISAplazo federal: 2022-03-08
Apply updates per vendor instructions.
Investigado y redactado con IA a partir del advisory del fabricante y análisis públicos, con las fuentes citadas. Verifica siempre la versión corregida en el advisory oficial antes de actuar.
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Zabbix · FrontendPoCs públicas encontradas — 38
githubgithub.com/Mr-xn/cve-2022-23131★ 154githubgithub.com/jweny/CVE-2022-23131★ 95githubgithub.com/L0ading-x/cve-2022-23131★ 29githubgithub.com/kh4sh3i/CVE-2022-23131★ 15githubgithub.com/Kazaf6s/CVE-2022-23131★ 11githubgithub.com/random-robbie/cve-2022-23131-exp★ 8githubgithub.com/SCAMagic/CVE-2022-23131poc-exp-zabbix-★ 8githubgithub.com/fork-bombed/CVE-2022-23131★ 4githubgithub.com/1mxml/CVE-2022-23131★ 3githubgithub.com/davidzzo23/CVE-2022-23131★ 3githubgithub.com/pykiller/CVE-2022-23131★ 2githubgithub.com/Vulnmachines/Zabbix-CVE-2022-23131★ 2githubgithub.com/trganda/CVE-2022-23131★ 1githubgithub.com/clearcdq/Zabbix-SAML-SSO-_CVE-2022-23131★ 1githubgithub.com/wr0x00/cve-2022-23131★ 1githubgithub.com/zwjjustdoit/cve-2022-23131★ 1githubgithub.com/Fa1c0n35/zabbix-cve-2022-23131★ 1githubgithub.com/qq1549176285/CVE-2022-23131★ 0githubgithub.com/Arrnitage/CVE-2022-23131_exp★ 0githubgithub.com/r10lab/CVE-2022-23131★ 0githubgithub.com/dagowda/Zabbix-cve-2022-23131-SSO-bypass★ 0githubgithub.com/Chaelsoo/CVE-2022-23131-Wrappers★ 0vulncheckvulncheck.com/xdb/26336c5bf065no verificadovulncheckvulncheck.com/xdb/87a03dbcb4d4no verificadovulncheckvulncheck.com/xdb/a91a49f498d6no verificadovulncheckvulncheck.com/xdb/6bf41d728409no verificadovulncheckvulncheck.com/xdb/0eca8abcd488no verificadovulncheckvulncheck.com/xdb/4bcdfe77a9b2no verificadovulncheckvulncheck.com/xdb/4fc1fafc24ecno verificadovulncheckvulncheck.com/xdb/004f3023163cno verificadovulncheckvulncheck.com/xdb/099f2ba1828ano verificadovulncheckvulncheck.com/xdb/3159b6a83e89no verificadovulncheckvulncheck.com/xdb/57651461a50bno verificadovulncheckvulncheck.com/xdb/e46f3b30212fno verificadovulncheckvulncheck.com/xdb/63bde8d02b8fno verificadovulncheckvulncheck.com/xdb/9edf8d0fe243no verificadovulncheckvulncheck.com/xdb/f0dbb969817bno verificadovulncheckvulncheck.com/xdb/b0a2be43d1ecno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.