CyberSecBulletin
CVE-2022-23134Exploited in the wildNVD status: Analyzed

Zabbix Frontend Improper Access Control

Published Updated By the CyberSecBulletin desk

CVE-2022-23134 is a medium-severity improper authentication vulnerability in Frontend from Zabbix, with a CVSS 3.1 base score of 5.3 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Frontend versions: 5.4.0 - 5.4.8. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on February 22, 2022, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Check which version of Frontend you run against the affected versions below, and install the vendor's latest release.
  2. CISA's required action: Apply updates per vendor instructions.
  3. Read the advisory on support.zabbix.com for workarounds and exact fixed builds.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
ZabbixFrontend5.4.0 - 5.4.8Not stated
ZabbixZabbix5.4.0 through 5.4.8; 6.0.0Not stated
Fedora ProjectFedora34; 35Not stated
DebianDebian Linux9.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
LowLimited modification of data is possible.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.13.7LowCNA (zabbix.com)
CVSS 3.15.3MediumNVD
CVSS 2.05.0MediumNVD

Official description

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How developers prevent this class of flaw

  • Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

More Improper Authentication vulnerabilities (CWE-287)

Timeline

  1. CVE record published.
  2. Added to CISA's Known Exploited Vulnerabilities catalogue.
  3. Deadline for US federal agencies to remediate, set by CISA.
  4. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: partial).
  5. Record last changed materially (score, affected products, status or references).

References

Advisories

Third-party and government advisories

Other vulnerabilities in Frontend

All Frontend vulnerabilities

Recent Improper Authentication vulnerabilities

Spotted an error? Tell us.