5.4
CVE-2022-35229
- EPSS 0.73%
- Veröffentlicht 06.07.2022 11:15:08
- Zuletzt bearbeitet 03.11.2025 22:15:58
- Quelle security@zabbix.com
- CVE-Watchlists
- Unerledigt
LoginReflected XSS in discovery page of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.73% | 0.496 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 3.5 | 6.8 | 2.9 |
AV:N/AC:M/Au:S/C:N/I:P/A:N
|
| security@zabbix.com | 3.7 | 1.2 | 2.5 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html
https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
https://support.zabbix.com/browse/ZBX-21306
https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html