Actively exploited in the wild

Zabbix Frontend Improper Access Control Vulnerability

Zabbix - Frontend · Listed in the CISA KEV since 2022-02-22. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2022-23134

LowCVSS 3.7KEV

Published: 13/01/2022(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

After the initial setup process, some steps of setup.php are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of the Zabbix Frontend.

Risk Assessment

An unauthenticated attacker can alter the Zabbix Frontend configuration, potentially leading to further attacks or system instability.

Recommendation

Secure setup.php from unauthenticated access or update Zabbix to a patched version.

Other vulnerabilities in Zabbix Frontend

CVE-2022-23131CriticalActively exploited
When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because the user login stored in the session was not verified. An unauthenticated attacker may exploit this to escalate privileges and gain admin access to Zabbix Frontend.

Original NVD description (English source)

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.