5.3
CVE-2022-23134
- EPSS 93.08%
- Veröffentlicht 13.01.2022 16:15:08
- Zuletzt bearbeitet 12.03.2025 21:01:25
- Quelle security@zabbix.com
- Teams Watchlist Login
- Unerledigt Login
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
22.02.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog
Zabbix Frontend Improper Access Control Vulnerability
SchwachstelleMalicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
BeschreibungApply updates per vendor instructions.
Erforderliche Maßnahmen| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 93.08% | 0.998 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|
| security@zabbix.com | 3.7 | 2.2 | 1.4 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.