Lucene search
Alpine Linux Development TeamALPINE:CVE-2022-23133HistoryJan 13, 2022 - 4:15 p.m.
CVE-2022-23133
2022-01-1316:15:00
Alpine Linux Development Team
security.alpinelinux.org
33
authenticated user
hosts group
xss payload
session hijacking
session cookies
impersonate users
account takeover
EPSS
0.001
Percentile
28.8%
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Alpine | edge-community | noarch | zabbix | = 6.0.0-r0 | UNKNOWN |
Related
prion
prion
Design/Logic Flaw
2022-01-13 16:15:00
cve
cve
CVE-2022-23133
2022-01-13 16:15:08
ubuntucve
ubuntucve
CVE-2022-23133
2022-01-13 00:00:00
cvelist
cvelist
osv
osv
CVE-2022-23133
2022-01-13 16:15:08
nvd
nvd
CVE-2022-23133
2022-01-13 16:15:08
debiancve
debiancve
CVE-2022-23133
2022-01-13 16:15:08
openvas
openvas
Fedora: Security Advisory for zabbix (FEDORA-2022-dfe346f53f)
2022-01-23 00:00:00
Fedora: Security Advisory for zabbix (FEDORA-2022-1a667b0f90)
2022-01-23 00:00:00
fedora
fedora
[SECURITY] Fedora 35 Update: zabbix-5.0.19-1.fc35
2022-01-23 01:44:38
[SECURITY] Fedora 34 Update: zabbix-5.0.19-1.fc34
2022-01-23 01:08:21
nessus
nessus
Zabbix 5.4.x < 5.4.9 Multiple Vulnerabilities
2022-02-28 00:00:00