5.4

CVE-2022-35229: zabbix frontend Cross-site Scripting

CVSS: 5.4v3.1MediumModified
AliasesUBUNTU-CVE-2022-35229DEBIAN-CVE-2022-35229
Published 06-07-2022Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2022-35229 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in zabbix frontend. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v3.1 (NVD)
EPSS score
0.81%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1
DLA-3390-1DLA-3909-1USN-6751-1

Timeline

  1. 06-07-2022
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.81%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

+0.03 pp

From 0.78% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.81%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Zabbix2 products
  • frontend4.0.0-4.0.42 | 5.0.0-5.0.24 | 6.0.0-6.0.4 | 6.2alpha1-6.2beta3
  • zabbixEOL< 4.0.0 | ≥ 5.0.0, < 5.0.25 | ≥ 6.0.0, ≤ 6.0.4 | 5.0.25
Debian1 product
  • zabbix< 1:6.0.7+dfsg-2
Ubuntu1 product
  • zabbix< 1:2.2.2+dfsg-1ubuntu1+esm5 | < 1:2.4.7+dfsg-2ubuntu2.1+esm4 | < 1:3.0.12+dfsg-1ubuntu0.1~esm4 | < 1:4.0.17+dfsg-1ubuntu0.1~esm2 | < 1:5.0.17+dfsg-1ubuntu0.1~esm1

3 vendors · 4 products

References

8 links