CVEvulnerability

CVE-2022-23133

5.4 MEDIUM Published 2022-01-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-01-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-79

Description

An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.

Affected configurations

• zabbix zabbix (>= 5.0.0 <= 5.0.18) • zabbix zabbix (>= 5.4.0 <= 5.4.8) • zabbix zabbix 6.0.0 • fedoraproject fedora 34 • fedoraproject fedora 35

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References