CVE-2022-43515: falha de média gravidade em Zabbix Frontend
X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 1.3%
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being disclosed. An attacker can bypass this protection and access the instance using IP address not listed in the defined range.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Zabbix · FrontendCVEs relacionadas — Zabbix Frontend
No mesmo produto, das mais perigosas para as menos.
CVE-2022-23131CRITICALUnsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAMLEPSS 95.7%KEVCVE-2022-23134LOWPossible view of the setup pages by unauthenticated users if config file already existsEPSS 93.9%KEVCVE-2022-24919LOWReflected XSS in graph configuration window of Zabbix FrontendEPSS 1.2%CVE-2022-24917LOWReflected XSS in service configuration window of Zabbix FrontendEPSS 1.2%CVE-2022-24349MEDIUMReflected XSS in action configuration window of Zabbix FrontendEPSS 1.2%CVE-2022-24918LOWReflected XSS in item configuration window of Zabbix FrontendEPSS 1.2%