CVE-2022-23134
KEVZabbix Frontend Improper Access Control Vulnerability
Description
Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NPublishedJan 13, 2022
Last modifiedJun 17, 2026
Added to KEVFeb 22, 2022
Remediation dueMar 8, 2022
References
- lists.debian.org/debian-lts-announce/2022/02/msg00008.htmlMailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/Release Notes
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/Release Notes
- support.zabbix.com/browse/ZBX-20384Issue TrackingPatch
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23134US Government Resource
0 recent articles mention this CVE
58
Risk assessment · Medium
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1693 days
- CVSS
- 3.7 LOW
- EPSS (30-day exploit probability)
- 95.3% · top 1% of all CVEs
- Weakness
- CWE-284
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.