CVE-2022-24349

An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:zabbix:frontend:*:*:*:*:*:*:*:*
cpe:2.3:a:zabbix:frontend:*:*:*:*:*:*:*:*
cpe:2.3:a:zabbix:frontend:*:*:*:*:*:*:*:*
cpe:2.3:a:zabbix:frontend:6.0.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

History

21 Nov 2024, 06:50

Type Values Removed Values Added
CVSS v2 : 2.1
v3 : 4.4
v2 : 2.1
v3 : 4.6
References () https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html - Third Party Advisory () https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html - () https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/ -
References () https://support.zabbix.com/browse/ZBX-20680 - Issue Tracking, Patch, Vendor Advisory () https://support.zabbix.com/browse/ZBX-20680 - Issue Tracking, Patch, Vendor Advisory

07 Nov 2023, 03:44

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/', 'name': 'FEDORA-2022-d714c0d39c', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/', 'name': 'FEDORA-2022-19a9053f17', 'tags': ['Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/', 'name': 'FEDORA-2022-5fab125c08', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/ -

Information

Published : 2022-03-09 20:15

Updated : 2024-11-21 06:50


NVD link : CVE-2022-24349

Mitre link : CVE-2022-24349

CVE.ORG link : CVE-2022-24349


JSON object : View

Products Affected

zabbix

  • frontend

debian

  • debian_linux

fedoraproject

  • fedora
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')