CVE-2022-24919
published 2022-03-09CVE-2022-24919: An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only…
PriorityP423medium4.4CVSS 3.1
AVNACHPRLUIRSCCLILAN
EPSS
1.20%
65.0th percentile
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | zabbix | < zabbix 1:6.0.7+dfsg-2 (bookworm) | zabbix 1:6.0.7+dfsg-2 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| zabbix | frontend | — | — |
| zabbix | frontend | — | — |
| zabbix | frontend | — | — |
| zabbix | frontend | — | — |
| zabbix | frontend | — | — |
| zabbix | frontend | 4.0.0 – 4.0.38 | — |
| zabbix | frontend | 5.0.0 – 5.0.20 | — |
| zabbix | frontend | 5.4.0 – 5.4.10 | — |
| zabbix | zabbix | >= 0 < 1:5.0.44+dfsg-1+deb11u1 | 1:5.0.44+dfsg-1+deb11u1 |
| zabbix | zabbix | >= 0 < 1:6.0.7+dfsg-2 | 1:6.0.7+dfsg-2 |
| zabbix | zabbix | >= 0 < 1:6.0.7+dfsg-2 | 1:6.0.7+dfsg-2 |
| zabbix | zabbix | >= 0 < 1:6.0.7+dfsg-2 | 1:6.0.7+dfsg-2 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.02.1LOWAV:N/AC:H/Au:S/C:N/I:P/A:N
osv4.4MEDIUM
vendor_debian3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cf7c-p4p5-gq5x: An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users
ghsa_unreviewed·2022-03-10
CVE-2022-24919 [MEDIUM] CWE-79 GHSA-cf7c-p4p5-gq5x: An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
OSV
CVE-2022-24919: An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users
osv·2022-03-09·CVSS 4.4
CVE-2022-24919 [MEDIUM] CVE-2022-24919: An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
Debian
CVE-2022-24919: zabbix - An authenticated user can create a link with reflected Javascript code inside it...
vendor_debian·2022·CVSS 3.7
CVE-2022-24919 [LOW] CVE-2022-24919: zabbix - An authenticated user can create a link with reflected Javascript code inside it...
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
Scope: local
bookworm: resolved (fixed in 1:6.0.7+dfsg-2)
bullseye: resolved (fixed in 1:5.0.44+dfsg-1+deb11u1)
forky: resolved (fixed in 1:6.0.7+dfsg-2)
sid: resolved (fixed in 1:6.0.7+dfsg-2)
trixie: resolved (fixed in 1:6.0.7+dfsg-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.debian.org/debian-lts-announce/2022/04/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2023/04/msg00013.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/https://support.zabbix.com/browse/ZBX-20680https://lists.debian.org/debian-lts-announce/2022/04/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2023/04/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2024/10/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/https://support.zabbix.com/browse/ZBX-20680
2022-03-09
Published