PT-2022-6805 · Zabbix+2 · Zabbix Frontend+3

Alexander Vladishev + 1 · Published 2022-10-18 · Updated 2024-10-03 · CVE-2022-43515

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zabbix Frontend (affected versions not specified)

Description The issue is related to the incorrect implementation of IP address checking in Zabbix Frontend, which allows an attacker to bypass protection and access the instance using an IP address not listed in the defined range. This could lead to unauthorized access to confidential data, disruption of data integrity, and potential denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

RCE

Weakness Enumeration

CWE-863

CWE-20

Related Identifiers

BDU:2023-04799

CVE-2022-43515

DLA-3538-1

DLA-3538-2

DLA-3909-1

SUSE-SU-2022:4477-1

SUSE-SU-2022_4477-1

Affected Products

Astra Linux

Suse

Zabbix

Zabbix Frontend

References · 28

• 🔥 https://support.zabbix.com/browse/ZBX-22050 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-43515 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-43515 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-43515 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4477-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-43515 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04799 · Security Note
• https://osv.dev/vulnerability/DLA-3538-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-43515 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3909-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43515 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43515 · Vendor Advisory