Log in Start free

Actively exploited · Published Jan 13, 2022 · Assigned by Zabbix

CVE-2022-23134Possible view of the setup pages by unauthenticated users if config file already exists

Low 3.7 Exploited

In plain English

A low-severity improper access control in Frontend from Zabbix. Attackers are actively exploiting it in the wild (listed by CISA on February 22, 2022). The chance it is exploited in the next 30 days is estimated at 95.3% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)95.3%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Feb 22, 2022
Attack tooling2Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 8, 2022.

Official description

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12zabbix1:6.0.7+dfsg-2DEBIAN-CVE-2022-23134
Debian:13zabbix1:6.0.7+dfsg-2DEBIAN-CVE-2022-23134
Debian:14zabbix1:6.0.7+dfsg-2DEBIAN-CVE-2022-23134

Affected products (as reported)

VendorProductVersions
Zabbix Frontend 5.4.0 - 5.4.8

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References