zabbix zabbix CVE-2022-23131 is a vulnerability in Zabbix
Published on January 13, 2022

In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).

Vendor Advisory NVD

Known Exploited Vulnerability

This Zabbix Frontend Authentication Bypass Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.

The following remediation steps are recommended / required by March 8, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2022-23131 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Authentication Bypass by Spoofing

This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.


Products Associated with CVE-2022-23131

You can be notified by stack.watch whenever vulnerabilities like CVE-2022-23131 are published in these products:

Zabbix
 

What versions of Zabbix are vulnerable to CVE-2022-23131?