CVE-2022-23134: Possible view of the setup pages by unauthenticated users if config file already exists

Medium severity · published Jan 13, 2022

CVE-2022-23134

Possible view of the setup pages by unauthenticated users if config file already exists

In wildKEV

5.3

CVSS

95.3%

EPSS

Yes

On KEV

Description

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)95.3% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Feb 22, 2022

Federal remediation dueMar 8, 2022

Ransomware campaign useNot known

Affected products

Which versions

Zabbix · Zabbix

5.4.0 - 5.4.8 · source: vendor, NVD, KEV

Debian Linux · Debian

9.0 · source: NVD

Fedora · Fedoraproject

34; 35 · source: NVD

Affected product

Zabbix

All Zabbix CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-23134

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-23134

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

x_refsource_MISC

https://support.zabbix.com/browse/ZBX-20384

vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/

vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/

mailing-list

https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html