CVE-2022-23134

MediumCVSS 5.3/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284 CWE-287

Affected software

Vendor	Product	Versions
Zabbix	Frontend	5.4.0 - 5.4.8

References

https://lists.debian.org/debian-lts-announce/2022/02/msg00008.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/Release Notes
https://support.zabbix.com/browse/ZBX-20384Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/02/msg00008.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/Release Notes
https://support.zabbix.com/browse/ZBX-20384Issue Tracking, Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23134US Government Resource

Timeline

Published: Jan 13, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 22, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-231356.5There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destinat CVE-2022-231365.4There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters a CVE-2022-231376.1ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and wh CVE-2022-231387.5ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, an CVE-2022-231398.8ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is incon CVE-2022-23149.8The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.CVE-2022-231417.5ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is CVE-2022-231425.3ZXEN CG200 has a DoS vulnerability. An attacker could construct and send a large number of HTTP GET requests in a short time, which can make CVE-2022-231436.5ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high pe CVE-2022-231449.1There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerabi CVE-2022-23159.4Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. Th CVE-2022-231557.2Dell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload vulnerability. A malicious user with admin privile