CVE-2022-23133: fedoraproject fedora Cross-site Scripting
Vulnerability summary
CVE-2022-23133 is a medium (CVSS 6.3) Cross-site Scripting vulnerability in fedoraproject fedora. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 13-01-2022PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.03%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
0.00 pp
From 1.03% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Zabbix2 products
Debian1 product
- zabbix< 1:6.0.7+dfsg-2
Fedoraproject1 product
- fedoraEOL34 | 35
Ubuntu1 product
- zabbixAll versions (No fix recorded)
4 vendors · 5 products
