{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T03:13:53.949","vulnerabilities":[{"cve":{"id":"CVE-2022-24349","sourceIdentifier":"security@zabbix.com","published":"2022-03-09T20:15:08.563","lastModified":"2026-06-17T04:31:40.427","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel."},{"lang":"es","value":"Un usuario autenticado puede crear un enlace con carga útil XSS reflejada para las páginas de acciones, y enviarlo a otros usuarios. El código malicioso tiene acceso a todos los mismos objetos que el resto de la página web y puede realizar modificaciones arbitrarias en el contenido de la página que se muestra a la víctima. Este ataque puede ser implementado con la ayuda de la ingeniería social y la expiración de una serie de factores - un atacante debe tener acceso autorizado al Zabbix Frontend y permitir la conexión de red entre un servidor malicioso y el ordenador de la víctima, entender la infraestructura atacada, ser reconocido por la víctima como un administrador y utilizar el canal de comunicación de confianza"}],"affected":[{"source":"security@zabbix.com","affectedData":[{"vendor":"Zabbix","product":"Frontend","versions":[{"version":"4.0.0-4.0.38","status":"affected"},{"version":"5.0.0-5.0.20","status":"affected"},{"version":"5.4.0-5.4.10","status":"affected"},{"version":"6.0","status":"affected"},{"version":"4.0.39rc1","lessThan":"unspecified","versionType":"custom","status":"unaffected"},{"version":"5.0.21rc1","lessThan":"unspecified","versionType":"custom","status":"unaffected"},{"version":"5.4.11rc1","lessThan":"unspecified","versionType":"custom","status":"unaffected"},{"version":"6.0.1rc1","lessThan":"unspecified","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@zabbix.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:N/I:P/A:N","baseScore":2.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security@zabbix.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zabbix:frontend:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndIncluding":"4.0.38","matchCriteriaId":"708A44D7-726F-4D4A-BB10-3B926689CA07"},{"vulnerable":true,"criteria":"cpe:2.3:a:zabbix:frontend:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndIncluding":"5.0.20","matchCriteriaId":"BE339A00-AE42-4A9E-9B1B-D5D120BE0512"},{"vulnerable":true,"criteria":"cpe:2.3:a:zabbix:frontend:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.0","versionEndIncluding":"5.4.10","matchCriteriaId":"1DF7E86D-391F-4E99-9F16-4C0A98C87D08"},{"vulnerable":true,"criteria":"cpe:2.3:a:zabbix:frontend:6.0.0:*:*:*:*:*:*:*","matchCriteriaId":"39A4F9FB-A20A-4AB0-A502-8526FD992FF2"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","matchCriteriaId":"A930E247-0B43-43CB-98FF-6CE7B8189835"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","matchCriteriaId":"80E516C0-98A4-4ADE-B69F-66A772E2BAAA"}]}]}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html","source":"security@zabbix.com","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html","source":"security@zabbix.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/","source":"security@zabbix.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/","source":"security@zabbix.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/","source":"security@zabbix.com"},{"url":"https://support.zabbix.com/browse/ZBX-20680","source":"security@zabbix.com","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.zabbix.com/browse/ZBX-20680","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"]}]}}]}