CVE-2022-23133

published 2022-01-13

CVE-2022-23133: An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an…

Priority P4 25 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	zabbix	< zabbix 1:6.0.7+dfsg-2 (bookworm)	zabbix 1:6.0.7+dfsg-2 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
zabbix	frontend	—	—
zabbix	frontend	—	—
zabbix	zabbix	—	—
zabbix	zabbix	>= 0 < 1:5.0.44+dfsg-1+deb11u1	1:5.0.44+dfsg-1+deb11u1
zabbix	zabbix	>= 0 < 1:6.0.7+dfsg-2	1:6.0.7+dfsg-2
zabbix	zabbix	>= 0 < 1:6.0.7+dfsg-2	1:6.0.7+dfsg-2
zabbix	zabbix	>= 0 < 1:6.0.7+dfsg-2	1:6.0.7+dfsg-2
zabbix	zabbix	5.0.0 – 5.0.18	—
zabbix	zabbix	5.4.0 – 5.4.8	—

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

osv 5.4 MEDIUM

vendor_debian 6.3 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79