CVE-2022-23134

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v3.1

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

84.66% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-02-22

Nuclei

medium

Published

2022-01-13

Updated

2025-10-21

Proof-of-concept exploits (1)

• TheN00bBuilder/cve-2022-23134-poc-and-writeup1★ · 2025-03-23

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23134.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-23134.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-23131
• CVE-2022-2314
• CVE-2022-23120
• CVE-2022-2317
• CVE-2022-2312
• CVE-2022-23178