PT-2023-9162 · Zabbix+4 · Zabbix+4

Sergejs Maklakovs · Published 2023-11-22 · Updated 2024-11-21 · CVE-2024-22119

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zabbix (affected versions not specified)

Description The issue is caused by improper validation of the form input field Name on the Graph page in the Items section. This can lead to a cross-site scripting (XSS) attack, allowing a remote attacker to exploit the vulnerability. XSS is a type of attack where an attacker injects malicious scripts into a website, potentially allowing them to steal user data or take control of the user's session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

ALT-PU-2024-15834

ALT-PU-2024-3075

ALT-PU-2024-3077

ALT-PU-2024-3365

BDU:2024-04280

CVE-2024-22119

DLA-3798-1

DLA-3909-1

OPENSUSE-SU-2024:0064-1

SUSE-SU-2024:0862-1

SUSE-SU-2024_0862-1

Affected Products

Alt Linux

Astra Linux

Debian

Suse

Zabbix

References · 109

• 🔥 https://support.zabbix.com/browse/ZBX-24070 · Exploit
• https://bdu.fstec.ru/vul/2024-06204 · Security Note
• https://bdu.fstec.ru/vul/2024-10777 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32728 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32722 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29450 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36467 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35230 · Security Note
• https://bdu.fstec.ru/vul/2023-09101 · Security Note
• https://bdu.fstec.ru/vul/2023-09104 · Security Note
• https://bdu.fstec.ru/vul/2024-00033 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22117 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32725 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22119 · Security Note
• https://bdu.fstec.ru/vul/2023-01710 · Security Note