5.4

CVE-2022-35230: zabbix frontend Cross-site Scripting

CVSS: 5.4v3.1MediumModified
AliasesSUSE-SU-2022:3101-1UBUNTU-CVE-2022-35230DEBIAN-CVE-2022-35230
Published 06-07-2022Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2022-35230 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in zabbix frontend. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.5% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v3.1 (NVD)
EPSS score
0.79%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1
DLA-3390-1DLA-3909-1USN-6751-1

Timeline

  1. 06-07-2022
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.79%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

+0.02 pp

From 0.77% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.79%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse2 products
  • zabbix&distro=SUSE Linux Enterprise Server 12 SP5< 4.0.12-4.18.1
  • zabbix&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 4.0.12-4.18.1
Zabbix2 products
  • frontend4.0.0-4.0.42 | 5.0.0-5.0.24
  • zabbixEOL< 5.0.25 | 5.0.25 | 5.0.25:rc1
Debian1 product
  • zabbix< 1:6.0.7+dfsg-2
Ubuntu1 product
  • zabbix< 1:2.2.2+dfsg-1ubuntu1+esm5 | < 1:2.4.7+dfsg-2ubuntu2.1+esm4 | < 1:3.0.12+dfsg-1ubuntu0.1~esm4 | < 1:4.0.17+dfsg-1ubuntu0.1~esm2 | < 1:5.0.17+dfsg-1ubuntu0.1~esm1

4 vendors · 6 products

References

10 links