CVE-2022-43515 — Improper Input Validation in Frontend

CWE-20 — Improper Input ValidationCWE-863 — Incorrect Authorization5 documents5 sources
Severity
9.8CRITICALNVD
CNA5.3
EPSS
0.2%
top 60.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ZabbixZabbix Frontend
Timeline
PublishedDec 5
Latest updateDec 12

Description

Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being disclosed. An attacker can bypass this protection and access the instance using IP address not listed in the defined range.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDzabbix/frontend4.0.0 — 4.0.44+6
▶CVEListV5zabbix/frontend4 versions+3
▶Debianzabbix/zabbix< 1:5.0.44+dfsg-1+deb11u1+3

🔴Vulnerability Details

3
CVEList
X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode↗2022-12-12
▶
OSV
CVE-2022-43515: Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it↗2022-12-05
▶
GHSA
GHSA-hh7f-cch9-52mr: Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it↗2022-12-05
▶

📋Vendor Advisories

1
Debian
CVE-2022-43515: zabbix - Zabbix Frontend provides a feature that allows admins to maintain the installati...↗2022
▶
CVE-2022-43515 — Improper Input Validation in Frontend | cvebase