Description
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Zabbix Frontend
5.4.0 - 5.4.8affected5.4.9 to < 5.4.9*unaffected
References
- https://support.zabbix.com/browse/ZBX-20384 ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/ ↗
- https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23134 ↗