CVE-2022-24919

zabbix frontend, debian linux, fedoraproject fedora

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-24919

Katalog CVE

CVSS 4.4 · Medium EPSS 1,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada zabbix frontend, debian linux +1 lainnya. Skor CVSS 3.1 4.4 (Medium) menurut NVD.

Deskripsi (NVD)

An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.

Rincian

Terbit di NVD
9 Maret 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
4.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari)
1,2% peluang dieksploitasi; lebih tinggi dari 67,9% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
zabbix frontend Versi 4.0.0 hingga 4.0.38
zabbix frontend Versi 5.0.0 hingga 5.0.20
zabbix frontend Versi 5.4.0 hingga 5.4.10
zabbix frontend Versi 6.0.0
debian debian linux Versi 9.0
fedoraproject fedora Versi 34
fedoraproject fedora Versi 35
fedoraproject fedora Versi 36

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.