CVEvulnerability

CVE-2022-23131

9.8 CRITICAL Known exploited Published 2022-01-13 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Zabbix Frontend Authentication Bypass Vulnerability — Zabbix Frontend

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.

Added to KEV
2022-02-22
Remediation due
2022-03-08
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2022-23131
Status
Analyzed
Published
2022-01-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.1 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:P
Weaknesses
CWE-290

Description

In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).

Affected configurations

• zabbix zabbix (>= 5.4.0 <= 5.4.8) • zabbix zabbix 6.0.0

Related

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

References