CVE-2022-23133: Stored XSS in host groups configuration window in Zabbix Frontend
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is CVE-2022-23133?
CVE-2022-23133 is a vulnerability in Zabbix that allows an authenticated user to create a hosts group from the configuration with an XSS payload, which can be used to steal information from other users.
How does CVE-2022-23133 affect Zabbix?
CVE-2022-23133 affects Zabbix versions 5.0.0 to 5.0.18, 5.4.0 to 5.4.8, and 6.0.0-alpha1. It also affects Fedora versions 34 and 35.
What is the severity of CVE-2022-23133?
CVE-2022-23133 has a severity rating of medium with a score of 5.4.
How can an authenticated user exploit CVE-2022-23133?
An authenticated user can exploit CVE-2022-23133 by creating a hosts group with an XSS payload in the configuration and then tricking other users into searching for groups during new host creation.
Are there any fixes or patches available for CVE-2022-23133?
Yes, fixes for CVE-2022-23133 are available. Please refer to the references for more information.