Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2022-40626

Reflected XSS in the backurl parameter of Zabbix Frontend

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zabbix

Description

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zabbix Frontend

  • 6.0.0-6.0.6affected
  • 6.2.0affected
  • 6.0.7rc1 to < unspecifiedunaffected
  • 6.2.1rc1 to < unspecifiedunaffected

References