CVE-2022-23134

LOW3.7

CISA KEV

Published 2022-01-13 · Updated 2026-06-17 · Source security@zabbix.com

Summary

CVE-2022-23134 is a low-severity (CVSS 3.7) vulnerability in Zabbix Frontend. CISA added it to the Known Exploited Vulnerabilities catalog on February 22, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 8, 2022. CISA does not currently list it as used in ransomware campaigns. Zabbix has 2 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 2 known-exploited Zabbix vulnerabilities →

Description

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-284CWE-287

CISA Known-Exploited Vulnerability

Product: Zabbix — Frontend

Name: Zabbix Frontend Improper Access Control Vulnerability

Date added: 2022-02-22 · Due: 2022-03-08

Required action: Apply updates per vendor instructions.

References

View on NVD

More exploited Zabbix vulnerabilities

Most recently added to CISA KEV

CVE-2022-23131
Frontend — Zabbix Frontend Authentication Bypass Vulnerability
added 2022-02-22

View all →

Related CVEs

Same severity, most recent

CVE-2026-71863
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1.
2026-11-06 · score 2.6
CVE-2026-124039
Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials.
2026-11-06 · score 3.3
CVE-2026-123357
GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversion path in grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java passes an attacker-influenced PDF filename through DocumentSource.pdfalto, which interpolates the path into a bash -c command string. A single quote in the filename can terminate the intended quoting, and ProcessRunner.run in grobid-core/src/main/java/org/grobid/core/process/ProcessRunner.java starts the resulting command through ProcessBuilder, allowing arbitrary commands to execute with GROBID process privileges. The bundled REST server path is not affected. This issue is fixed in version 0.9.1.
2026-11-06 · score 0.0
CVE-2026-123850
In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives
2026-11-06 · score 3.5
CVE-2026-123845
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects
2026-11-06 · score 3.3