{"id":"CVE-2022-23134","details":"After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.","modified":"2026-07-08T06:03:12.755825026Z","published":"2022-01-13T16:15:08.227Z","related":["openSUSE-SU-2022:0036-1","openSUSE-SU-2024:11772-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_RANGE","vendor_product":"zabbix:zabbix","cpes":["cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.4.0"},{"last_affected":"5.4.8"}]},{"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"34"},{"last_affected":"34"},{"introduced":"35"},{"last_affected":"35"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23134"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/"},{"type":"FIX","url":"https://support.zabbix.com/browse/ZBX-20384"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zabbix/zabbix","events":[{"introduced":"f56fed83bc4778f6c8fdc6bedc956d6c2059c56b"},{"last_affected":"d3db14ccb5597f10b6353202ac3519cb2c42c556"}],"database_specific":{"extracted_events":[{"introduced":"6.0.0-alpha1"},{"last_affected":"6.0.0-alpha1"},{"introduced":"6.0.0-alpha2"},{"last_affected":"6.0.0-alpha2"},{"introduced":"6.0.0-alpha3"},{"last_affected":"6.0.0-alpha3"},{"introduced":"6.0.0-alpha4"},{"last_affected":"6.0.0-alpha4"},{"introduced":"6.0.0-alpha5"},{"last_affected":"6.0.0-alpha5"},{"introduced":"6.0.0-alpha6"},{"last_affected":"6.0.0-alpha6"},{"introduced":"6.0.0-alpha7"},{"last_affected":"6.0.0-alpha7"},{"introduced":"6.0.0-beta1"},{"last_affected":"6.0.0-beta1"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:zabbix:zabbix:6.0.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:6.0.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:6.0.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:6.0.0:alpha4:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:6.0.0:alpha5:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:6.0.0:alpha6:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:6.0.0:alpha7:*:*:*:*:*:*","cpe:2.3:a:zabbix:zabbix:6.0.0:beta1:*:*:*:*:*:*"]}}],"versions":["6.0.0-alpha1","6.0.0-alpha2","6.0.0-alpha3","6.0.0-alpha4","6.0.0-alpha5","6.0.0-alpha6","6.0.0-alpha7","6.0.0-beta1","6.0.0beta1","6.0.0alpha7","6.0.0alpha6","6.0.0alpha5","6.0.0alpha4","6.0.0alpha3","6.0.0alpha2","6.0.0alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23134.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}