CVE-2022-23133

Stored XSS in host groups configuration window in Zabbix Frontend

State: Published
Severity: 6.3 Medium
Published: Jan 13, 2022
Updated: Nov 3, 2025
Reserved: Jan 11, 2022

Description

An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	Zabbix

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
FrontendZabbix	5.0.0 – 5.0.18Affected 5.4.0 – 5.4.8Affected 5.0.19 to before 5.0.19Not affected 5.4.9 to before 5.4.9Not affected

References

https://support.zabbix.com/browse/ZBX-20388
FEDORA-2022-dfe346f53fvendor-advisory
FEDORA-2022-1a667b0f90vendor-advisory
https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.