Log in Start free

Vulnerability · Published Mar 9, 2022 · Assigned by Zabbix

CVE-2022-24919Reflected XSS in graph configuration window of Zabbix Frontend

Low 3.7

In plain English

A low-severity cross-site scripting in Frontend from Zabbix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)1.2%top 31.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12zabbix1:6.0.7+dfsg-2DEBIAN-CVE-2022-24919
Debian:13zabbix1:6.0.7+dfsg-2DEBIAN-CVE-2022-24919
Debian:14zabbix1:6.0.7+dfsg-2DEBIAN-CVE-2022-24919

Affected products (as reported)

VendorProductVersions
Zabbix Frontend 4.0.0-4.0.385.0.0-5.0.205.4.0-5.4.106.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

References