CVE-2022-35229
published 2022-07-06CVE-2022-35229: An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed…
PriorityP423medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.73%
50.5th percentile
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | zabbix | < zabbix 1:6.0.7+dfsg-2 (bookworm) | zabbix 1:6.0.7+dfsg-2 (bookworm) |
| zabbix | frontend | — | — |
| zabbix | frontend | — | — |
| zabbix | frontend | — | — |
| zabbix | frontend | — | — |
| zabbix | zabbix | < 4.0.0 | 4.0.0 |
| zabbix | zabbix | — | — |
| zabbix | zabbix | >= 0 < 1:5.0.44+dfsg-1+deb11u1 | 1:5.0.44+dfsg-1+deb11u1 |
| zabbix | zabbix | >= 0 < 1:6.0.7+dfsg-2 | 1:6.0.7+dfsg-2 |
| zabbix | zabbix | >= 0 < 1:6.0.7+dfsg-2 | 1:6.0.7+dfsg-2 |
| zabbix | zabbix | >= 0 < 1:6.0.7+dfsg-2 | 1:6.0.7+dfsg-2 |
| zabbix | zabbix | >= 0 < 1:2.2.2+dfsg-1ubuntu1+esm5 | 1:2.2.2+dfsg-1ubuntu1+esm5 |
| zabbix | zabbix | >= 0 < 1:2.4.7+dfsg-2ubuntu2.1+esm4 | 1:2.4.7+dfsg-2ubuntu2.1+esm4 |
| zabbix | zabbix | >= 0 < 1:3.0.12+dfsg-1ubuntu0.1~esm4 | 1:3.0.12+dfsg-1ubuntu0.1~esm4 |
| zabbix | zabbix | >= 0 < 1:4.0.17+dfsg-1ubuntu0.1~esm2 | 1:4.0.17+dfsg-1ubuntu0.1~esm2 |
| zabbix | zabbix | >= 0 < 1:5.0.17+dfsg-1ubuntu0.1~esm1 | 1:5.0.17+dfsg-1ubuntu0.1~esm1 |
| zabbix | zabbix | >= 5.0.0 < 5.0.25 | 5.0.25 |
| zabbix | zabbix | 6.0.0 – 6.0.4 | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv5.4MEDIUM
vendor_debian3.7LOW
vendor_ubuntu3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Zabbix vulnerabilities
vendor_ubuntu·2024-04-25·CVSS 3.7
CVE-2022-35230 [LOW] Zabbix vulnerabilities
Title: Zabbix vulnerabilities
Summary: Zabbix could allow reflected cross-site scripting (XSS) attacks.
It was discovered that Zabbix incorrectly handled input data in the
discovery and graphs pages. A remote authenticated attacker could possibly
use this issue to perform reflected cross-site scripting (XSS) attacks.
(CVE-2022-35229, CVE-2022-35230)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2022-35229: zabbix - An authenticated user can create a link with reflected Javascript code inside it...
vendor_debian·2022·CVSS 3.7
CVE-2022-35229 [LOW] CVE-2022-35229: zabbix - An authenticated user can create a link with reflected Javascript code inside it...
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
Scope: local
bookworm: resolved (fixed in 1:6.0.7+dfsg-2)
bullseye: resolved (fixed in 1:5.0.44+dfsg-1+deb11u1)
forky: resolved (fixed in 1:6.0.7+dfsg-2)
sid: resolved (fixed in 1:6.0.7+dfsg-2)
trixie: resolved (fixed in 1:6.0.7+dfsg-2)
OSV
zabbix vulnerabilities
osv·2024-04-25·CVSS 5.4
CVE-2022-35229 [MEDIUM] zabbix vulnerabilities
zabbix vulnerabilities
It was discovered that Zabbix incorrectly handled input data in the
discovery and graphs pages. A remote authenticated attacker could possibly
use this issue to perform reflected cross-site scripting (XSS) attacks.
(CVE-2022-35229, CVE-2022-35230)
GHSA
GHSA-44qv-5wxp-8xqv: An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users
ghsa_unreviewed·2022-07-07
CVE-2022-35229 [MEDIUM] CWE-79 GHSA-44qv-5wxp-8xqv: An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
OSV
CVE-2022-35229: An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users
osv·2022-07-06·CVSS 5.4
CVE-2022-35229 [MEDIUM] CVE-2022-35229: An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.debian.org/debian-lts-announce/2023/04/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2023/08/msg00027.htmlhttps://support.zabbix.com/browse/ZBX-21306https://lists.debian.org/debian-lts-announce/2023/04/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2023/08/msg00027.htmlhttps://lists.debian.org/debian-lts-announce/2024/10/msg00000.htmlhttps://support.zabbix.com/browse/ZBX-21306
2022-07-06
Published