5.3
CVE-2022-23134
- EPSS 93.08%
- Published 13.01.2022 16:15:08
- Last modified 12.03.2025 21:01:25
- Source security@zabbix.com
- Teams watchlist Login
- Open Login
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
Data is provided by the National Vulnerability Database (NVD)
22.02.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog
Zabbix Frontend Improper Access Control Vulnerability
VulnerabilityMalicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
DescriptionApply updates per vendor instructions.
Required actions| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 93.08% | 0.998 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|
| security@zabbix.com | 3.7 | 2.2 | 1.4 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.