CVE-2022-23134: Zabbix Frontend Improper Access Control Vulnerability

Vulnerability summary

CVE-2022-23134 is a medium (CVSS 5.3) Improper Access Control vulnerability in Zabbix Frontend. It is known to be exploited: CISA lists it, first on 22-02-2022. EPSS estimates a 95.26% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities.

Timeline

1. 13-01-2022
   PublishedVulnerability first disclosed.
2. 22-02-2022
   Added to CISA KEVZabbix Frontend Improper Access Control Vulnerability
3. 08-03-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.