PT-2021-7720 · Zabbix+2 · Zabbix+2

Hazem Osama · Published 2021-12-08 · Updated 2024-10-03 · CVE-2022-23133

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Zabbix (affected versions not specified)

Description The issue is related to the lack of protection of the web page structure in Zabbix, allowing a remote attacker to impact data integrity. An authenticated user can create a hosts group from the configuration with an XSS payload, which will be available for other users. When the XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire, and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-3617

ALT-PU-2022-2499

ALT-PU-2023-6268

BDU:2023-01708

CVE-2022-23133

DLA-3909-1

Affected Products

Alt Linux

Astra Linux

Zabbix

References · 20

• https://osv.dev/vulnerability/DLA-3909-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23133 · Security Note
• https://bdu.fstec.ru/vul/2023-01708 · Security Note
• https://support.zabbix.com/browse/ZBX-20388 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23133 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23133 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-23133 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23133 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23133 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23133 · Vendor Advisory
• https://altsp.su/obnovleniya-bezopasnosti · Note