CVE-2022-24349: debian debian_linux Cross-site Scripting

Vulnerability summary

CVE-2022-24349 is a medium (CVSS 4.6) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 1.22% chance of exploitation in the next 30 days, higher than 68.2% of scored vulnerabilities.

Timeline

1. 09-03-2022
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.