{"id":"CVE-2022-24349","aliases":["DEBIAN-CVE-2022-24349","DLA-2980-1","DLA-3390-1","DLA-3909-1","EUVD-2022-29245","GHSA-vv83-2f3m-pvxg","SUSE-SU-2022:1254-1","UBUNTU-CVE-2022-24349","openSUSE-SU-2024:11934-1"],"status":"published","title":"Reflected XSS in action configuration window of Zabbix Frontend","description":"An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01222,"percentile":0.69095,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-03-09T19:30:26Z","modified":"2026-11-03T08:01:03Z","fixes":[{"ecosystem":"Debian:12","package":"zabbix","fixed_in":["1:6.0.7+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zabbix","fixed_in":["1:6.0.7+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zabbix","fixed_in":["1:6.0.7+dfsg-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.7+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.7+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.7+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.32+dfsg-0+deb9u3"}]}],"versions":["1:3.0.12+dfsg-1","1:3.0.17+dfsg-1","1:3.0.17+dfsg-1~bpo9+1","1:3.0.31+dfsg-0+deb9u1","1:3.0.32+dfsg-0+deb9u1","1:3.0.32+dfsg-0+deb9u2","1:3.0.7+dfsg-3","1:3.0.7+dfsg-3+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.4+dfsg-1+deb10u1"}]}],"versions":["1:4.0.4+dfsg-1"],"bundled":8},{"source":"osv","ecosystem":"Debian:11","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0.44+dfsg-1+deb11u1"}]}],"versions":["1:5.0.14+dfsg-1","1:5.0.14+dfsg-1~bpo11+1","1:5.0.17+dfsg-1","1:5.0.17+dfsg-1~bpo11+1","1:5.0.8+dfsg-1"],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-4.15.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-4.15.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.0.4+dfsg-1build2","1:4.0.4+dfsg-1build3","1:4.0.11+dfsg-1","1:4.0.14+dfsg-1","1:4.0.15+dfsg-1","1:4.0.16+dfsg-1","1:4.0.16+dfsg-1build1","1:4.0.17+dfsg-1","1:4.0.17+dfsg-1ubuntu0.1~esm1","1:4.0.17+dfsg-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.0.8+dfsg-1build1","1:5.0.14+dfsg-1","1:5.0.17+dfsg-1","1:5.0.17+dfsg-1ubuntu0.1~esm1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"dependencytrack","product":"frontend"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"zabbix","product":"frontend"}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-20680","tags":["x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html","tags":["mailing-list","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24349"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7"},{"url":"https://github.com/advisories/GHSA-vv83-2f3m-pvxg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24349","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221254-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196944","tags":["report"]},{"url":"https://bugzilla.suse.com/1196945","tags":["report"]},{"url":"https://bugzilla.suse.com/1196946","tags":["report"]},{"url":"https://bugzilla.suse.com/1196947","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24919","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-24349","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24349","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-24349","title":"Reflected XSS in action configuration window of Zabbix Frontend","description":"An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.","status":"published","published":"2022-03-09T19:30:26.724Z","modified":"2025-11-03T21:46:03.748Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:34.940806Z"}],"euvd":[{"id":"EUVD-2022-29245","description":"An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.","status":"published","published":"2022-03-09T19:30:26Z","modified":"2025-11-03T21:46:03Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:31.25882Z"}],"ghsa":[{"id":"GHSA-vv83-2f3m-pvxg","title":"An authenticated user can create a link with reflected XSS payload for actions’ pages, and send...","description":"An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users.\nMalicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.","status":"published","published":"2022-03-10T00:00:29Z","modified":"2025-11-04T00:31:33Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:28.385807Z"}],"nvd":[{"id":"CVE-2022-24349","description":"An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.","status":"published","published":"2022-03-09T20:15:08.563Z","modified":"2026-06-17T04:31:40.427Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:N/AC:H/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"CVE-2022-24349","description":"An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.","status":"published","published":"2022-03-09T20:15:08.563Z","modified":"2026-03-15T22:44:51.611249Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-24349","description":"An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.","status":"published","published":"2022-03-09T20:15:08.563Z","modified":"2026-11-03T08:01:03.623767395Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"UBUNTU-CVE-2022-24349","description":"An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.","status":"published","published":"2022-03-09T20:15:00Z","modified":"2025-10-24T04:53:30Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DLA-2980-1","title":"zabbix - security update","status":"published","published":"2022-04-12T00:00:00Z","modified":"2026-03-09T01:20:32.378439Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3390-1","title":"zabbix - security update","status":"published","published":"2023-04-12T00:00:00Z","modified":"2026-03-09T01:18:24.778318Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3909-1","title":"zabbix - security update","status":"published","published":"2024-10-03T00:00:00Z","modified":"2026-03-09T01:19:42.6614Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:11934-1","title":"zabbix-agent-4.0.39-1.1 on GA media","description":"These are all security issues fixed in the zabbix-agent-4.0.39-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:02.052113Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:1254-1","title":"Security update for zabbix","description":"This update for zabbix fixes the following issues:\n\n- CVE-2022-24349: Fixed a reflected XSS in the action configuration window (bsc#1196944).\n- CVE-2022-24917: Fixed a reflected XSS in the service configuration window (bsc#1196945).\n- CVE-2022-24918: Fixed a reflected XSS in the item configuration window (bsc#1196946).\n- CVE-2022-24919: Fixed a reflected XSS in the graph configuration window (bsc#1196947).\n","status":"published","published":"2022-04-19T07:12:53Z","modified":"2026-02-04T04:00:52.581388Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}