Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-23134

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

Published

2022-01-13T16:15:08.227

Last Modified

2025-03-12T21:01:25.843

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 3.7 (LOW)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-284
  • Type: Primary
    CWE-287
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application zabbix zabbix ≤ 5.4.8 Yes
Application zabbix zabbix 6.0.0 Yes
Application zabbix zabbix 6.0.0 Yes
Application zabbix zabbix 6.0.0 Yes
Application zabbix zabbix 6.0.0 Yes
Application zabbix zabbix 6.0.0 Yes
Application zabbix zabbix 6.0.0 Yes
Application zabbix zabbix 6.0.0 Yes
Application zabbix zabbix 6.0.0 Yes
Operating System fedoraproject fedora 34 Yes
Operating System fedoraproject fedora 35 Yes
Operating System debian debian_linux 9.0 Yes
References