Vulnerability · Published Jul 6, 2022 · Assigned by Zabbix
CVE-2022-35230Reflected XSS in graphs page of Zabbix Frontend
Low 3.7
In plain English
A low-severity cross-site scripting in Frontend from Zabbix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)1.2%top 31.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | zabbix | 1:6.0.7+dfsg-2 | DEBIAN-CVE-2022-35230 |
| Debian:13 | zabbix | 1:6.0.7+dfsg-2 | DEBIAN-CVE-2022-35230 |
| Debian:14 | zabbix | 1:6.0.7+dfsg-2 | DEBIAN-CVE-2022-35230 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N