CVE-2022-24349: Reflected XSS in action configuration window of Zabbix Frontend
First published: Wed Mar 09 2022(Updated: )
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.
Credit: security@zabbix.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zabbix Frontend | >=4.0.0<=4.0.38 | |
| Zabbix Frontend | >=5.0.0<=5.0.20 | |
| Zabbix Frontend | >=5.4.0<=5.4.10 | |
| Zabbix Frontend | =6.0.0 | |
| Debian Debian Linux | =9.0 | |
| Fedoraproject Fedora | =34 | |
| Fedoraproject Fedora | =35 |
Remedy
To remediate this vulnerability, apply the updates
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/
- https://support.zabbix.com/browse/ZBX-20680
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-24349.
What is the severity of CVE-2022-24349?
The severity of CVE-2022-24349 is medium.
Which software versions are affected by CVE-2022-24349?
Zabbix Frontend versions between 4.0.0 and 4.0.38, versions between 5.0.0 and 5.0.20, versions between 5.4.0 and 5.4.10, and version 6.0.0 are affected. Debian Linux version 9.0, Fedora versions 34 and 35 are also affected.
What can an authenticated user do with CVE-2022-24349?
An authenticated user can create a link with reflected XSS payload for actions' pages, and send it to other users, allowing them to execute malicious code on the victims' browsers.
How can CVE-2022-24349 be fixed?
To fix CVE-2022-24349, users should update to a patched version of Zabbix Frontend and apply any necessary patches provided by Debian or Fedora if applicable.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/remedy
- agent/references
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/zabbix
- canonical/zabbix frontend
- version/zabbix frontend/4.0.0
- version/zabbix frontend/4.0.38
- version/zabbix frontend/5.0.0
- version/zabbix frontend/5.0.20
- version/zabbix frontend/5.4.0
- version/zabbix frontend/5.4.10
- version/zabbix frontend/6.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- version/fedoraproject fedora/35